fix(ci): reject unsafe release dispatch tags

Author: MikeTomlin19

.github/workflows/release.yml

@@ -86,12 +86,18 @@ jobs:
         run: |
           set -euo pipefail
           TAG="${DISPATCH_TAG:-$RELEASE_TAG}"
+          case "$TAG" in
+            ""|*[!A-Za-z0-9._-]*)
+              echo "::error::release tag is empty or contains invalid characters"
+              exit 1
+              ;;
+          esac
           case "$TAG" in
             v[0-9]*) ;;
             *) echo "::error::'$TAG' does not look like a release tag (vX.Y.Z)"; exit 1 ;;
           esac
-          echo "tag=$TAG" >> "$GITHUB_OUTPUT"
-          echo "version=${TAG#v}" >> "$GITHUB_OUTPUT"
+          printf '%s\n' "tag=$TAG" >> "$GITHUB_OUTPUT"
+          printf '%s\n' "version=${TAG#v}" >> "$GITHUB_OUTPUT"
           # ghcr requires a lowercase repository path, and unlike metadata-action,
           # buildx's `--output name=` does no lowercasing — a mixed-case owner
           # makes the digest push fail with "invalid reference format".
@@ -183,12 +189,18 @@ jobs:
         run: |
           set -euo pipefail
           TAG="${DISPATCH_TAG:-$RELEASE_TAG}"
+          case "$TAG" in
+            ""|*[!A-Za-z0-9._-]*)
+              echo "::error::release tag is empty or contains invalid characters"
+              exit 1
+              ;;
+          esac
           case "$TAG" in
             v[0-9]*) ;;
             *) echo "::error::'$TAG' does not look like a release tag (vX.Y.Z)"; exit 1 ;;
           esac
-          echo "tag=$TAG" >> "$GITHUB_OUTPUT"
-          echo "version=${TAG#v}" >> "$GITHUB_OUTPUT"
+          printf '%s\n' "tag=$TAG" >> "$GITHUB_OUTPUT"
+          printf '%s\n' "version=${TAG#v}" >> "$GITHUB_OUTPUT"
 
       - name: Download digests
         uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
@@ -412,12 +424,18 @@ jobs:
         run: |
           set -euo pipefail
           TAG="${DISPATCH_TAG:-$RELEASE_TAG}"
+          case "$TAG" in
+            ""|*[!A-Za-z0-9._-]*)
+              echo "::error::release tag is empty or contains invalid characters"
+              exit 1
+              ;;
+          esac
           case "$TAG" in
             v[0-9]*) ;;
             *) echo "::error::'$TAG' does not look like a release tag (vX.Y.Z)"; exit 1 ;;
           esac
-          echo "tag=$TAG" >> "$GITHUB_OUTPUT"
-          echo "version=${TAG#v}" >> "$GITHUB_OUTPUT"
+          printf '%s\n' "tag=$TAG" >> "$GITHUB_OUTPUT"
+          printf '%s\n' "version=${TAG#v}" >> "$GITHUB_OUTPUT"
 
       - name: Checkout release tag
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2