Sanitize Semantic Version Input

[sshropshire]

Summary of changes

• This PR sanitizes the version string input to the create release PR workflow during manual dispatch

Checklist

• Added a changelog entry

Authors

List GitHub usernames for everyone who contributed to this pull request.

• @sshropshire

[MikeThorntonPayPal]

The ${{ }} expression is interpolated directly into the bash command before validation occurs, which means an attacker could inject commands before the regex check happens.

Suggested change

	- name: Validate Version Name
	run: |
	# Ref: https://github.com/orgs/community/discussions/48373#discussioncomment-7543209
	# Ref: https://semver.org/#is-there-a-suggested-regular-expression-regex-to-check-a-semver-string
	echo "Validating version name to make sure it adheres to semantic versioning..."
	echo "${{ github.event.inputs.versionName }}" | grep -P '^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:-((?:0|[1-9]\d*|\d*[a-zA-Z-][0-9a-zA-Z-]*)(?:\.(?:0|[1-9]\d*|\d*[a-zA-Z-][0-9a-zA-Z-]*))*))?(?:\+([0-9a-zA-Z-]+(?:\.[0-9a-zA-Z-]+)*))?$'
	- name: Validate Version Name
	env:
	VERSION_INPUT: ${{ github.event.inputs.versionName }}
	run: |
	# Ref: https://github.com/orgs/community/discussions/48373#discussioncomment-7543209
	# Ref: https://semver.org/#is-there-a-suggested-regular-expression-regex-to-check-a-semver-string
	echo "Validating version name to make sure it adheres to semantic versioning..."
	echo "$VERSION_INPUT" | grep -P '^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:-((?:0|[1-9]\d*|\d*[a-zA-Z-][0-9a-zA-Z-]*)(?:\.(?:0|[1-9]\d*|\d*[a-zA-Z-][0-9a-zA-Z-]*))*))?(?:\+([0-9a-zA-Z-]+(?:\.[0-9a-zA-Z-]+)*))?$'