Use "git check-ref-format" for release tags

Uses "git check-ref-format" for defense-in-depth check of
input tags (values). Resolves review comments for PR #279.

Author: data-douser

.github/workflows/release-codeql.yml

@@ -54,6 +54,10 @@ jobs:
             echo "::error::Version '${RAW_VERSION}' does not match ^vMAJOR.MINOR.PATCH(-PRERELEASE)?$"
             exit 1
           fi
+          if ! git check-ref-format "refs/tags/${RAW_VERSION}" >/dev/null 2>&1; then
+            echo "::error::Version '${RAW_VERSION}' is not a valid git tag ref name"
+            exit 1
+          fi
           echo "version=${RAW_VERSION}" >> "$GITHUB_OUTPUT"
           echo "release_name=${RAW_VERSION#v}" >> "$GITHUB_OUTPUT"
 

.github/workflows/release-npm.yml

@@ -51,6 +51,10 @@ jobs:
             echo "::error::Version '${RAW_VERSION}' does not match ^vMAJOR.MINOR.PATCH(-PRERELEASE)?$"
             exit 1
           fi
+          if ! git check-ref-format "refs/tags/${RAW_VERSION}" >/dev/null 2>&1; then
+            echo "::error::Version '${RAW_VERSION}' is not a valid git tag ref name"
+            exit 1
+          fi
           echo "version=${RAW_VERSION}" >> "$GITHUB_OUTPUT"
           echo "release_name=${RAW_VERSION#v}" >> "$GITHUB_OUTPUT"
 

.github/workflows/release-tag.yml

@@ -51,14 +51,14 @@ jobs:
         env:
           RAW_VERSION: ${{ inputs.version }}
         run: |
-          # Strict version format: vMAJOR.MINOR.PATCH with optional
-          # prerelease suffix made of alphanumerics, dots, and hyphens.
-          # This keeps the resolved outputs free of shell-metacharacters
-          # so they are safe to interpolate in later run: blocks.
           if [[ ! "${RAW_VERSION}" =~ ^v[0-9]+\.[0-9]+\.[0-9]+(-[A-Za-z0-9.-]+)?$ ]]; then
             echo "::error::Version '${RAW_VERSION}' does not match ^vMAJOR.MINOR.PATCH(-PRERELEASE)?$"
             exit 1
           fi
+          if ! git check-ref-format "refs/tags/${RAW_VERSION}" >/dev/null 2>&1; then
+            echo "::error::Version '${RAW_VERSION}' is not a valid git tag ref name"
+            exit 1
+          fi
           echo "version=${RAW_VERSION}" >> "$GITHUB_OUTPUT"
           echo "release_name=${RAW_VERSION#v}" >> "$GITHUB_OUTPUT"
 

.github/workflows/release-vsix.yml

@@ -52,6 +52,10 @@ jobs:
             echo "::error::Version '${RAW_VERSION}' does not match ^vMAJOR.MINOR.PATCH(-PRERELEASE)?$"
             exit 1
           fi
+          if ! git check-ref-format "refs/tags/${RAW_VERSION}" >/dev/null 2>&1; then
+            echo "::error::Version '${RAW_VERSION}' is not a valid git tag ref name"
+            exit 1
+          fi
           echo "version=${RAW_VERSION}" >> "$GITHUB_OUTPUT"
           echo "release_name=${RAW_VERSION#v}" >> "$GITHUB_OUTPUT"
 

.github/workflows/release.yml

@@ -72,14 +72,17 @@ jobs:
             VERSION="${REF_NAME}"
           fi
 
-          # Strict version format: vMAJOR.MINOR.PATCH with optional
-          # prerelease suffix made of alphanumerics, dots, and hyphens.
-          # This keeps the resolved outputs free of shell-metacharacters
-          # so they are safe to interpolate in later run: blocks.
+          # Validate the resolved version: strict regex first, then
+          # git check-ref-format so values like 'v1.2.3-..' (regex-valid but
+          # rejected by git) are caught here instead of in actions/checkout.
           if [[ ! "${VERSION}" =~ ^v[0-9]+\.[0-9]+\.[0-9]+(-[A-Za-z0-9.-]+)?$ ]]; then
             echo "::error::Version '${VERSION}' does not match ^vMAJOR.MINOR.PATCH(-PRERELEASE)?$"
             exit 1
           fi
+          if ! git check-ref-format "refs/tags/${VERSION}" >/dev/null 2>&1; then
+            echo "::error::Version '${VERSION}' is not a valid git tag ref name"
+            exit 1
+          fi
 
           # Resolve publish flags (default true for tag pushes)
           if [ "${EVENT_NAME}" == "workflow_dispatch" ]; then

CHANGELOG.md

@@ -31,7 +31,7 @@ _Changes on `main` since the latest tagged release that have not yet been includ
 - The `setup-codeql-environment` composite action now sets up Rust (default `1.80.0`, configurable via `rust-version`) when `rust` is in the `languages` input, including a dedicated cache for `~/.cargo`/`~/.rustup` and a Cargo dependency-file detector. **Rust is opt-in only** — it is intentionally NOT included in the default `languages` value (`csharp,go,java,javascript,python,ruby`) because the Rust toolchain (rustc + cargo + rust-src) is a several-hundred-megabyte download. Callers that need Rust support must pass an explicit `languages:` override that includes `rust` (e.g. `languages: ${{ matrix.language }}` from a per-language matrix entry). ([#279](https://github.com/advanced-security/codeql-development-mcp-server/pull/279))
 - The `setup-codeql-environment` composite action now matches the `languages` input with comma-bounded tokens (`contains(format(',{0},', inputs.languages), ',java,')`) instead of bare substring `contains()`. This fixes a latent bug where the JavaScript matrix entry triggered the Java setup steps because `contains('javascript', 'java')` was true. ([#279](https://github.com/advanced-security/codeql-development-mcp-server/pull/279))
 - `query-unit-tests.yml` matrix entries now pass `languages: ${{ matrix.language }}` to the composite action so each language matrix entry installs only its own runtime instead of the full default set, and `runs-on` is pinned to `ubuntu-24.04`. ([#279](https://github.com/advanced-security/codeql-development-mcp-server/pull/279))
-- All release workflow `version` inputs (in `release.yml`, `release-tag.yml`, `release-npm.yml`, `release-vsix.yml`, `release-codeql.yml`) now document the actual accepted format (`^vMAJOR.MINOR.PATCH(-PRERELEASE)?$` where `PRERELEASE` may contain alphanumerics, dots, and hyphens) and are validated against that regex via an `env:` intermediate variable. ([#279](https://github.com/advanced-security/codeql-development-mcp-server/pull/279))
+- All release workflow `version` inputs (in `release.yml`, `release-tag.yml`, `release-npm.yml`, `release-vsix.yml`, `release-codeql.yml`) now document the actual accepted format (`^vMAJOR.MINOR.PATCH(-PRERELEASE)?$` where `PRERELEASE` may contain alphanumerics, dots, and hyphens) and are validated against that regex via an `env:` intermediate variable. Validation also runs `git check-ref-format "refs/tags/${VERSION}"` so values that pass the regex but are rejected by git as a tag ref (e.g. `v1.2.3-..`, `v1.2.3-foo.`, `v1.2.3-foo.lock`, `v1.2.3-a..b`) are caught up front instead of failing later in `actions/checkout`. ([#279](https://github.com/advanced-security/codeql-development-mcp-server/pull/279))
 
 ### Fixed