From ead36545d3a160788738a5743c0c0d6edf21f14f Mon Sep 17 00:00:00 2001
From: vicrodh <103399283+vicrodh@users.noreply.github.com>
Date: Sun, 1 Mar 2026 09:19:37 -0600
Subject: [PATCH] fix(actions): harden release-aur workflow permissions and
 input handling

cx
---
 .github/workflows/release-aur.yml | 17 ++++++++++++++---
 1 file changed, 14 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/release-aur.yml b/.github/workflows/release-aur.yml
index 09143614b..51fe5be9d 100644
--- a/.github/workflows/release-aur.yml
+++ b/.github/workflows/release-aur.yml
@@ -21,6 +21,9 @@ concurrency:
   group: aur-publish
   cancel-in-progress: false
 
+permissions:
+  contents: read
+
 jobs:
   update-aur:
     runs-on: ubuntu-latest
@@ -32,13 +35,21 @@ jobs:
 
       - name: Determine version
         id: version
+        env:
+          EVENT_NAME: ${{ github.event_name }}
+          WORKFLOW_HEAD_BRANCH: ${{ github.event.workflow_run.head_branch }}
+          DISPATCH_VERSION: ${{ inputs.version }}
         run: |
-          if [[ "${{ github.event_name }}" == "workflow_run" ]]; then
+          if [[ "$EVENT_NAME" == "workflow_run" ]]; then
             # Extract version from the triggering workflow's head branch (tag)
-            REF="${{ github.event.workflow_run.head_branch }}"
+            REF="$WORKFLOW_HEAD_BRANCH"
+            if [[ ! "$REF" =~ ^v[0-9]+(\.[0-9]+){1,3}([.-][0-9A-Za-z.-]+)?$ ]]; then
+              echo "Invalid workflow_run head branch for release: $REF"
+              exit 1
+            fi
             VERSION="${REF#v}"
           else
-            VERSION="${{ inputs.version }}"
+            VERSION="$DISPATCH_VERSION"
           fi
           echo "version=$VERSION" >> "$GITHUB_OUTPUT"
           echo "Detected version: $VERSION"