fix: prevent command substitution in release tag validation

[imnotStealthy]

Motivation

• Prevent command-substitution command-injection in the release workflow where ${{ inputs.tag }} was interpolated directly into a Bash run script, which could execute $(...) before the regex check in a job with contents: write and later GH_TOKEN use.

Description

• Update the Validate release tag format step in .github/workflows/release-macos.yml to export the input via env: TAG: ${{ inputs.tag }} and validate with [[ "$TAG" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]] instead of interpolating ${{ inputs.tag }} directly.

Testing

• Verified by running npm run build (TypeScript compile) and npm test (vitest), and all tests passed. Inspect .github/workflows/release-macos.yml to confirm the env: TAG change and the new [[ "$TAG" =~ ... ]] check.

---

Codex Task

[Copilot]

Pull request overview

Hardens the macOS release workflow against command-substitution injection by avoiding direct interpolation of the workflow_dispatch tag input into a Bash script, ensuring the tag is validated safely before proceeding in a job that can write release contents.

Changes:

• Pass ${{ inputs.tag }} into the validation step via env: TAG rather than embedding it directly in the Bash script.
• Validate the tag using [[ "$TAG" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]] to prevent command substitution from being evaluated.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.