fix: validate manual release versions before workflow outputs

[mldangelo-oai]

Summary

• Validate both manual ModelAudit release-version inputs before writing GitHub Actions outputs or invoking release commands.
• Reject newline, shell-metacharacter, malformed-semver, and leading-zero inputs while preserving empty selections and protected provenance recovery.

Validation

• 148 release-workflow tests passed.
• 25 independent malformed/version-injection and valid-path shell probes passed.
• Ruff, formatting, mypy, and Prettier passed.
• Three independent exact-head native Codex security reviews found no issues.

[mldangelo-oai]

@codex review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Another round soon, please!

Reviewed commit: 95756b8c9b

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[Copilot]

Pull request overview

This PR hardens the release workflow’s manual version inputs by validating root_version and picklescan_version before any GitHub Actions outputs are written, preventing malformed semver and output/shell injection attempts from influencing downstream release steps.

Changes:

• Add strict X.Y.Z semver validation (no v prefix, prerelease tags, leading zeroes, or metacharacters/newlines) for manual root_version and picklescan_version inputs in the release-please workflow step.
• Refactor release-workflow tests to reuse a shared harness for executing the “Resolve manual release inputs” Bash step.
• Add regression tests covering invalid/manual-injection inputs (ensuring no outputs file is created) and valid semver paths (ensuring expected outputs are written).

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File	Description
tests/test_release_workflow.py	Adds a shared helper to execute the manual-input resolution step and expands test coverage for invalid/valid manual version inputs.
.github/workflows/release-please.yml	Validates manual version inputs via a strict semver regex prior to writing $GITHUB_OUTPUT or proceeding with release logic.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[chatgpt-codex-connector]

Security review completed. No security issues were found in this pull request.

Reviewed commit: 95756b8c9b

View security finding report

ℹ️ About Codex security reviews in GitHub

This is an experimental Codex feature. Security reviews are triggered when:

• You comment "@codex security review"
• A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review

Once complete, Codex will leave suggestions, or a comment if no findings are found.

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 76.29%. Comparing base (64d4f52) to head (95756b8).

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #1794      +/-   ##
==========================================
- Coverage   76.29%   76.29%   -0.01%     
==========================================
  Files         217      217              
  Lines      115676   115676              
  Branches    27245    27245              
==========================================
- Hits        88258    88256       -2     
- Misses      20022    20023       +1     
- Partials     7396     7397       +1     

see 1 file with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.