From ca132d854278581094c7e18a8e3d007944dca91a Mon Sep 17 00:00:00 2001
From: Matthew Bain <66839492+rocketstack-matt@users.noreply.github.com>
Date: Tue, 25 Aug 2026 15:29:46 +0100
Subject: [PATCH] ci: pass PR head ref via env and validate release version in
 calm-models publish workflow

The Maven Central publish workflow interpolated github.event.pull_request.head.ref
directly into a run: script, and the derived release version then flowed into two
further shell steps the same way. Pass both through env: instead so bash treats
them as data, and validate the extracted version against a strict semver pattern
before it's used to tag, deploy, or open a follow-up PR.

Closes the OSPS-BR-01.01 / OSPS-BR-01.02 findings from the LFX Insights build and
release review.
---
 .../release-calm-models-maven-publish.yml         | 15 +++++++++++----
 1 file changed, 11 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/release-calm-models-maven-publish.yml b/.github/workflows/release-calm-models-maven-publish.yml
index 93c795c85..99d9954fc 100644
--- a/.github/workflows/release-calm-models-maven-publish.yml
+++ b/.github/workflows/release-calm-models-maven-publish.yml
@@ -17,9 +17,15 @@ jobs:
         steps:
             - name: Extract release version
               id: version
+              env:
+                REF: ${{ github.event.pull_request.head.ref }}
               run: |
-                REF="${{ github.event.pull_request.head.ref }}"
-                echo "release_version=${REF#release-prep/calm-models-v}" >> "$GITHUB_OUTPUT"
+                RELEASE_VERSION="${REF#release-prep/calm-models-v}"
+                if ! [[ "$RELEASE_VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
+                  echo "::error::Branch name did not yield a valid semver release version: $REF"
+                  exit 1
+                fi
+                echo "release_version=$RELEASE_VERSION" >> "$GITHUB_OUTPUT"
 
             - name: Checkout main at merge commit
               uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
@@ -47,8 +53,9 @@ jobs:
                 git config --global url."https://x-access-token:${{ secrets.GITHUB_TOKEN }}@github.com/".insteadOf "https://github.com/"
 
             - name: Tag release
+              env:
+                RELEASE_VERSION: ${{ steps.version.outputs.release_version }}
               run: |
-                RELEASE_VERSION="${{ steps.version.outputs.release_version }}"
                 git tag -a "calm-models-v${RELEASE_VERSION}" -m "calm-models v${RELEASE_VERSION}"
                 git push origin "calm-models-v${RELEASE_VERSION}"
 
@@ -66,8 +73,8 @@ jobs:
             - name: Prepare next development iteration PR
               env:
                 GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+                RELEASE_VERSION: ${{ steps.version.outputs.release_version }}
               run: |
-                RELEASE_VERSION="${{ steps.version.outputs.release_version }}"
                 IFS='.' read -r MAJOR MINOR PATCH <<< "$RELEASE_VERSION"
                 NEXT_VERSION="${MAJOR}.${MINOR}.$((PATCH + 1))-SNAPSHOT"
                 BRANCH="release-prep/calm-models-next-dev-v${NEXT_VERSION}"