validate sha input

Author: witmicko

.github/workflows/manual-publish-release.yml

@@ -59,22 +59,46 @@ jobs:
         uses: actions/checkout@v4
         with:
           fetch-depth: 0
-      - name: Get full SHA
+      - name: Validate and resolve commit SHA
         id: get-sha
+        env:
+          INPUT_COMMIT_SHA: ${{ github.event.inputs.commit-sha }}
         run: |
-          FULL_SHA=$(git rev-parse ${{ github.event.inputs.commit-sha }})
-          if [ -z "$FULL_SHA" ]; then
-            echo "Error: Could not resolve commit SHA: ${{ github.event.inputs.commit-sha }}"
+          # Validate input matches SHA pattern (7-40 hex characters)
+          if ! echo "$INPUT_COMMIT_SHA" | grep -qE '^[0-9a-fA-F]{7,40}$'; then
+            echo "Error: Invalid commit SHA format. Must be 7-40 hexadecimal characters."
+            echo "Provided: $INPUT_COMMIT_SHA"
             exit 1
           fi
+
+          # Resolve to full SHA
+          FULL_SHA=$(git rev-parse "$INPUT_COMMIT_SHA" 2>&1)
+          EXIT_CODE=$?
+
+          if [ $EXIT_CODE -ne 0 ] || [ -z "$FULL_SHA" ]; then
+            echo "Error: Could not resolve commit SHA: $INPUT_COMMIT_SHA"
+            echo "$FULL_SHA"
+            exit 1
+          fi
+
+          # Validate resolved SHA is actually a commit
+          if ! git cat-file -e "$FULL_SHA^{commit}" 2>/dev/null; then
+            echo "Error: $FULL_SHA is not a valid commit"
+            exit 1
+          fi
+
           echo "FULL_SHA=$FULL_SHA" >> "$GITHUB_OUTPUT"
           echo "Resolved commit SHA: $FULL_SHA"
       - name: Checkout specific commit
-        run: git checkout ${{ steps.get-sha.outputs.FULL_SHA }}
+        env:
+          COMMIT_SHA: ${{ steps.get-sha.outputs.FULL_SHA }}
+        run: git checkout "$COMMIT_SHA"
       - name: Show commit details
+        env:
+          COMMIT_SHA: ${{ steps.get-sha.outputs.FULL_SHA }}
         run: |
           echo "Commit details:"
-          git log -1 --pretty=format:"Author: %an <%ae>%nDate: %ad%nSubject: %s%nBody: %b" ${{ steps.get-sha.outputs.FULL_SHA }}
+          git log -1 --pretty=format:"Author: %an <%ae>%nDate: %ad%nSubject: %s%nBody: %b" "$COMMIT_SHA"
       - name: Get package info
         id: package-info
         run: |
@@ -84,8 +108,10 @@ jobs:
           echo "PACKAGE_VERSION=$PACKAGE_VERSION" >> "$GITHUB_OUTPUT"
           echo "Package: $PACKAGE_NAME@$PACKAGE_VERSION"
       - name: Check for existing release
+        env:
+          PACKAGE_VERSION: ${{ steps.package-info.outputs.PACKAGE_VERSION }}
         run: |
-          TAG="v${{ steps.package-info.outputs.PACKAGE_VERSION }}"
+          TAG="v${PACKAGE_VERSION}"
           if git rev-parse "$TAG" >/dev/null 2>&1; then
             echo "⚠️  Warning: Tag $TAG already exists"
             git log -1 --pretty=format:"Existing tag points to: %H%n" "$TAG"
@@ -100,12 +126,16 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Display dry run summary
+        env:
+          PACKAGE_NAME: ${{ needs.validate-commit.outputs.PACKAGE_NAME }}
+          PACKAGE_VERSION: ${{ needs.validate-commit.outputs.PACKAGE_VERSION }}
+          FULL_SHA: ${{ needs.validate-commit.outputs.FULL_SHA }}
         run: |
           echo "## 🔍 Dry Run Summary"
           echo ""
           echo "**Mode:** Dry run (no changes will be made)"
-          echo "**Package:** ${{ needs.validate-commit.outputs.PACKAGE_NAME }}@${{ needs.validate-commit.outputs.PACKAGE_VERSION }}"
-          echo "**Commit:** ${{ needs.validate-commit.outputs.FULL_SHA }}"
+          echo "**Package:** ${PACKAGE_NAME}@${PACKAGE_VERSION}"
+          echo "**Commit:** ${FULL_SHA}"
           echo ""
           echo "✓ All validation checks passed"
           echo "ℹ️  To publish this release, run the workflow again with 'Dry run' unchecked"