[plan] Validate APM version string before YAML injection in compiler

[github-actions]

Context

From security audit discussion #21454 (Sergo Run 24, 2026-03-17). New finding in Run 24.

Problem

The version: field under dependencies: in workflow frontmatter is extracted verbatim and injected into the compiled YAML output as a double-quoted string with no format validation:

// compiler_yaml.go:617
apmVersion = data.APMDependencies.Version  // direct from user frontmatter, no validation

// compiler_yaml.go:654
fmt.Fprintf(yaml, "          GH_AW_INFO_APM_VERSION: \"%s\"\n", apmVersion)
// ^^^ no escaping — a '"' in apmVersion produces invalid YAML

The codebase already has isValidVersionTag() in pkg/workflow/semver.go:18 (regex: ^v[0-9]+(\.[0-9]+(\.[0-9]+)?)?$) used elsewhere for version validation, but it is not applied to the APM version field.

A value like v0.8.0" (trailing double-quote) produces GH_AW_INFO_APM_VERSION: "v0.8.0"" — syntactically invalid YAML in the generated workflow file.

Severity: MEDIUM — User error or malformed input silently produces invalid compiled YAML.
New finding: Run 24 (2026-03-17).

Files to Modify

• pkg/workflow/frontmatter_extraction_metadata.go — add isValidVersionTag() validation when extracting the version: field (around lines 398-401)
• pkg/workflow/compiler_yaml.go — secondary injection point at line 654 (if not fixed upstream)
• Also check pkg/workflow/compiler_activation_job.go:518-523 for the same injection via env map

Approach

Add validation in extractAPMDependenciesFromFrontmatter() at frontmatter_extraction_metadata.go:

if versionStr, ok := versionAny.(string); ok && versionStr != "" {
    if !isValidVersionTag(versionStr) {
        return nil, fmt.Errorf("dependencies.version %q is not a valid semver tag (expected format: vX.Y.Z)", versionStr)
    }
    version = versionStr
}

Return a compiler error (consistent with strict validation elsewhere) rather than silently ignoring an invalid value.

Acceptance Criteria

• A workflow with dependencies.version: 'v0.8.0"' produces a compiler error with a clear message
• A workflow with a valid semver like v1.2.3 compiles without error
• isValidVersionTag() from semver.go is used for validation
• compiler_activation_job.go:518-523 env injection path is also validated or relies on upstream fix
• Tests added in apm_dependencies_compilation_test.go for valid and invalid version strings
• make agent-finish passes with no errors

Generated by Plan Command for issue #discussion #21454 · ◷

• expires on Mar 19, 2026, 11:44 PM UTC