ci: harden production quality gates

scripts/ci-validate-semver.sh

@@ -0,0 +1,22 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+tag=${1:-}
+
+die() {
+  printf 'invalid release tag: %s\n' "$tag" >&2
+  exit 1
+}
+
+[[ $tag == v* ]] || die
+version=${tag#v}
+
+# Bash arrays discard trailing empty fields, so parsing first would accept
+# values such as v1.2.3. and v1.2.3-alpha. Validate the complete string with
+# the SemVer 2.0.0 grammar before doing anything else with the tag.
+semver_pattern='^(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)(-((0|[1-9][0-9]*|[0-9]*[A-Za-z-][0-9A-Za-z-]*)(\.(0|[1-9][0-9]*|[0-9]*[A-Za-z-][0-9A-Za-z-]*))*))?(\+([0-9A-Za-z-]+(\.[0-9A-Za-z-]+)*))?$'
+LC_ALL=C
+export LC_ALL
+[[ $version =~ $semver_pattern ]] || die
+
+printf 'release_tag=PASS tag=%s\n' "$tag"