Add workflow_dispatch trigger to release workflow for manual re-runs #14

Copilot commented 2026年03月16日 01:40:02 +01:00 (Migrated from github.com)

• Add workflow_dispatch trigger with a required tag input
• Add resolve-tag job that validates the tag exists and outputs the effective tag
• All jobs check out the resolved tag via ref:
• Build ldflags version uses resolved tag
• GitHub Release step uses tag_name and prerelease from resolved tag
• Fix concurrency group: use github.ref_name (not github.ref) so push and dispatch paths produce the same format for the same tag
• Fix shell injection: pass inputs.tag via env: and validate with a POSIX character allowlist before writing to $GITHUB_OUTPUT; use env: in validate step too

---

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.

- [x] Add `workflow_dispatch` trigger with a required `tag` input - [x] Add `resolve-tag` job that validates the tag exists and outputs the effective tag - [x] All jobs check out the resolved tag via `ref:` - [x] Build ldflags version uses resolved tag - [x] GitHub Release step uses `tag_name` and `prerelease` from resolved tag - [x] Fix concurrency group: use `github.ref_name` (not `github.ref`) so push and dispatch paths produce the same format for the same tag - [x] Fix shell injection: pass `inputs.tag` via `env:` and validate with a POSIX character allowlist before writing to `$GITHUB_OUTPUT`; use `env:` in validate step too <!-- START COPILOT CODING AGENT TIPS --> --- ✨ Let Copilot coding agent [set things up for you](https://github.com/peterwwillis/zop/issues/new?title=✨+Set+up+Copilot+instructions&body=Configure%20instructions%20for%20this%20repository%20as%20documented%20in%20%5BBest%20practices%20for%20Copilot%20coding%20agent%20in%20your%20repository%5D%28https://gh.io/copilot-coding-agent-tips%29%2E%0A%0A%3COnboard%20this%20repo%3E&assignees=copilot) — coding agent works faster and does higher quality work when set up for your repo.

github-actions[bot] commented 2026年03月17日 02:18:37 +01:00 (Migrated from github.com)

Mobile UI Screenshot

zop mobile UI

### Mobile UI Screenshot  <!-- Sticky Pull Request Commentzop-mobile-ui -->

peterwwillis commented 2026年03月17日 02:20:40 +01:00 (Migrated from github.com)

@copilot apply changes based on the comments in this thread

@copilot apply changes based on the comments in [this thread](https://github.com/peterwwillis/zop/pull/14#pullrequestreview-3957671054)

Copilot commented 2026年03月17日 02:22:35 +01:00 (Migrated from github.com)

@copilot apply changes based on the comments in this thread

Done in e40369a. Two fixes applied:

1. Concurrency group — changed github.ref → github.ref_name so both the push path (refs/tags/v1.2.3 → v1.2.3) and the dispatch path (inputs.tag = v1.2.3) produce the same string, enabling correct per-tag deduplication.

2. Shell injection — inputs.tag is now passed through env: (INPUT_TAG) instead of being interpolated directly into the bash script. The value is validated against a POSIX character allowlist ([^a-zA-Z0-9._/\-]) before being written to $GITHUB_OUTPUT via printf. The "Validate tag exists" step also uses env: for the tag output value.

> @copilot apply changes based on the comments in [this thread](https://github.com/peterwwillis/zop/pull/14#pullrequestreview-3957671054) Done in e40369a. Two fixes applied: 1. **Concurrency group** — changed `github.ref` → `github.ref_name` so both the push path (`refs/tags/v1.2.3` → `v1.2.3`) and the dispatch path (`inputs.tag` = `v1.2.3`) produce the same string, enabling correct per-tag deduplication. 2. **Shell injection** — `inputs.tag` is now passed through `env:` (`INPUT_TAG`) instead of being interpolated directly into the bash script. The value is validated against a POSIX character allowlist (`[^a-zA-Z0-9._/\-]`) before being written to `$GITHUB_OUTPUT` via `printf`. The "Validate tag exists" step also uses `env:` for the tag output value.