From fee9c73f22f17d6ee96e5857e1c4c3413b48e6c6 Mon Sep 17 00:00:00 2001
From: "S." <stealthylabs@protonmail.com>
Date: Fri, 8 May 2026 21:21:53 +0200
Subject: [PATCH] fix: prevent command substitution in release tag validation

---
 .github/workflows/release-macos.yml | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/release-macos.yml b/.github/workflows/release-macos.yml
index 62d6d90..8d7ffa4 100644
--- a/.github/workflows/release-macos.yml
+++ b/.github/workflows/release-macos.yml
@@ -19,9 +19,11 @@ jobs:
       contents: write
     steps:
       - name: Validate release tag format
+        env:
+          TAG: ${{ inputs.tag }}
         run: |
           set -euo pipefail
-          [[ "${{ inputs.tag }}" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]]
+          [[ "$TAG" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]]
 
       - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332
         with: