fix(actions): harden release-aur workflow permissions and input handling

cx

.github/workflows/release-aur.yml

@@ -21,6 +21,9 @@ concurrency:
   group: aur-publish
   cancel-in-progress: false
 
+permissions:
+  contents: read
+
 jobs:
   update-aur:
     runs-on: ubuntu-latest
@@ -32,13 +35,21 @@ jobs:
 
       - name: Determine version
         id: version
+        env:
+          EVENT_NAME: ${{ github.event_name }}
+          WORKFLOW_HEAD_BRANCH: ${{ github.event.workflow_run.head_branch }}
+          DISPATCH_VERSION: ${{ inputs.version }}
         run: |
-          if [[ "${{ github.event_name }}" == "workflow_run" ]]; then
+          if [[ "$EVENT_NAME" == "workflow_run" ]]; then
             # Extract version from the triggering workflow's head branch (tag)
-            REF="${{ github.event.workflow_run.head_branch }}"
+            REF="$WORKFLOW_HEAD_BRANCH"
+            if [[ ! "$REF" =~ ^v[0-9]+(\.[0-9]+){1,3}([.-][0-9A-Za-z.-]+)?$ ]]; then
+              echo "Invalid workflow_run head branch for release: $REF"
+              exit 1
+            fi
             VERSION="${REF#v}"
           else
-            VERSION="${{ inputs.version }}"
+            VERSION="$DISPATCH_VERSION"
           fi
           echo "version=$VERSION" >> "$GITHUB_OUTPUT"
           echo "Detected version: $VERSION"