fix(ci): harden version validation and verify sed substitutions in release pipelines (#59)

Two security/reliability improvements applied to all three PyPI release
workflows (splunk-ao, splunk-ao-adk, splunk-ao-a2a):

1. Switch grep -Eq to bash [[ =~ ]] for version validation
   grep -E matches on a per-line basis, so a multi-line input like
   "0.1.0\n<payload>" passes the check even though it is not a valid
   version. bash [[ =~ ]] anchors ^ and $ to the entire string, making
   multi-line inputs impossible to sneak through.

2. Verify each sed substitution actually matched
   If the version line format in pyproject.toml or the __version__ file
   ever drifts, sed silently no-ops and the build proceeds with the
   stale version. Added grep -q assertions after each sed call so a
   mismatch fails loudly instead of producing a silent wrong-version
   release.

Co-authored-by: Cursor <cursoragent@cursor.com>

Author: adityamehra

.github/workflows/release-splunk-ao-a2a.yaml

@@ -31,12 +31,22 @@ jobs:
         env:
           INPUT_VERSION: ${{ inputs.version }}
         run: |
-          if ! printf '%s' "$INPUT_VERSION" | grep -Eq '^[0-9]+\.[0-9]+\.[0-9]+((a|b|rc)[0-9]+)?(\.post[0-9]+)?(\.dev[0-9]+)?$'; then
+          # Use bash [[ =~ ]] so ^ and $ anchor the entire string, preventing
+          # multi-line inputs from bypassing the validation (grep -E matches per line).
+          if [[ ! "$INPUT_VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+((a|b|rc)[0-9]+)?(\.post[0-9]+)?(\.dev[0-9]+)?$ ]]; then
             echo "::error::Invalid version '${INPUT_VERSION}'. Expected an explicit version like 0.1.0, 1.2.3rc1, or 1.2.3.post1. Bump keywords like 'patch' or 'major' are not accepted."
             exit 1
           fi
           sed -i "s/^version = \".*\"/version = \"${INPUT_VERSION}\"/" pyproject.toml
+          if ! grep -q "^version = \"${INPUT_VERSION}\"" pyproject.toml; then
+            echo "::error::Failed to set version in pyproject.toml — the version line format may have changed."
+            exit 1
+          fi
           sed -i "s/__version__ = \".*\"/__version__ = \"${INPUT_VERSION}\"/" src/splunk_ao_a2a/_version.py
+          if ! grep -q "__version__ = \"${INPUT_VERSION}\"" src/splunk_ao_a2a/_version.py; then
+            echo "::error::Failed to set __version__ in src/splunk_ao_a2a/_version.py — the version line format may have changed."
+            exit 1
+          fi
 
       - name: Get current version
         id: get-version

.github/workflows/release-splunk-ao-adk.yaml

@@ -31,12 +31,22 @@ jobs:
         env:
           INPUT_VERSION: ${{ inputs.version }}
         run: |
-          if ! printf '%s' "$INPUT_VERSION" | grep -Eq '^[0-9]+\.[0-9]+\.[0-9]+((a|b|rc)[0-9]+)?(\.post[0-9]+)?(\.dev[0-9]+)?$'; then
+          # Use bash [[ =~ ]] so ^ and $ anchor the entire string, preventing
+          # multi-line inputs from bypassing the validation (grep -E matches per line).
+          if [[ ! "$INPUT_VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+((a|b|rc)[0-9]+)?(\.post[0-9]+)?(\.dev[0-9]+)?$ ]]; then
             echo "::error::Invalid version '${INPUT_VERSION}'. Expected an explicit version like 0.1.0, 1.2.3rc1, or 1.2.3.post1. Bump keywords like 'patch' or 'major' are not accepted."
             exit 1
           fi
           sed -i "s/^version = \".*\"/version = \"${INPUT_VERSION}\"/" pyproject.toml
+          if ! grep -q "^version = \"${INPUT_VERSION}\"" pyproject.toml; then
+            echo "::error::Failed to set version in pyproject.toml — the version line format may have changed."
+            exit 1
+          fi
           sed -i "s/__version__ = \".*\"/__version__ = \"${INPUT_VERSION}\"/" src/splunk_ao_adk/__init__.py
+          if ! grep -q "__version__ = \"${INPUT_VERSION}\"" src/splunk_ao_adk/__init__.py; then
+            echo "::error::Failed to set __version__ in src/splunk_ao_adk/__init__.py — the version line format may have changed."
+            exit 1
+          fi
 
       - name: Get current version
         id: get-version

.github/workflows/release-splunk-ao.yaml

@@ -31,12 +31,22 @@ jobs:
         env:
           INPUT_VERSION: ${{ inputs.version }}
         run: |
-          if ! printf '%s' "$INPUT_VERSION" | grep -Eq '^[0-9]+\.[0-9]+\.[0-9]+((a|b|rc)[0-9]+)?(\.post[0-9]+)?(\.dev[0-9]+)?$'; then
+          # Use bash [[ =~ ]] so ^ and $ anchor the entire string, preventing
+          # multi-line inputs from bypassing the validation (grep -E matches per line).
+          if [[ ! "$INPUT_VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+((a|b|rc)[0-9]+)?(\.post[0-9]+)?(\.dev[0-9]+)?$ ]]; then
             echo "::error::Invalid version '${INPUT_VERSION}'. Expected an explicit version like 0.1.0, 1.2.3rc1, or 1.2.3.post1. Bump keywords like 'patch' or 'major' are not accepted."
             exit 1
           fi
           sed -i "s/^version = \".*\"/version = \"${INPUT_VERSION}\"/" pyproject.toml
+          if ! grep -q "^version = \"${INPUT_VERSION}\"" pyproject.toml; then
+            echo "::error::Failed to set version in pyproject.toml — the version line format may have changed."
+            exit 1
+          fi
           sed -i "s/__version__ = \".*\"/__version__ = \"${INPUT_VERSION}\"/" src/splunk_ao/__init__.py
+          if ! grep -q "__version__ = \"${INPUT_VERSION}\"" src/splunk_ao/__init__.py; then
+            echo "::error::Failed to set __version__ in src/splunk_ao/__init__.py — the version line format may have changed."
+            exit 1
+          fi
 
       - name: Get current version
         id: get-version