From bf87a8a4e9f6a734e167171f8bd21e428c8f6577 Mon Sep 17 00:00:00 2001
From: abhiramshaji-cyber <write4abhiram@gmail.com>
Date: Tue, 27 Oct 2026 14:51:00 -0400
Subject: [PATCH] action: validate the version input and accept a leading v

A version written as a tag, such as v1.98.10, was passed through
unchanged. The action then logged "Resolved Tailscale version:
v1.98.10" and requested tailscale_v1.98.10_amd64.tgz.sha256, which
returns 404, and on macOS ran "git checkout vv1.98.10".

Strip one leading "v" from the version input and reject anything that
is not X.Y.Z, "latest" or "unstable" with an error that names the
value and the accepted forms. The check runs in getInputs, so the
macOS cache check, validateAuth and resolveVersion all see the
normalized value.

Fixes #316

Signed-off-by: abhiramshaji-cyber <write4abhiram@gmail.com>
---
 dist/index.js | 12 +++++++++++-
 src/main.ts   | 15 ++++++++++++++-
 2 files changed, 25 insertions(+), 2 deletions(-)

diff --git a/dist/index.js b/dist/index.js
index e59b833..24b1876 100644
--- a/dist/index.js
+++ b/dist/index.js
@@ -52347,7 +52347,7 @@ async function getInputs() {
         }
     }
     const config = {
-        version: core.getInput("version") || "1.94.2",
+        version: parseVersion(core.getInput("version") || "1.94.2"),
         resolvedVersion: "",
         arch: "",
         authKey: authKey,
@@ -52371,6 +52371,16 @@ async function getInputs() {
     }
     return config;
 }
+function parseVersion(input) {
+    if (input === versionLatest || input === versionUnstable) {
+        return input;
+    }
+    const version = input.replace(/^v/, "");
+    if (!/^\d+\.\d+\.\d+$/.test(version)) {
+        throw new Error(`Invalid version "${input}": use a version number such as 1.104.2, "latest", or "unstable".`);
+    }
+    return version;
+}
 function validateAuth(config) {
     if (!config.authKey &&
         (!config.oauthSecret || !config.tags) &&
diff --git a/src/main.ts b/src/main.ts
index 109d4c1..73fb892 100644
--- a/src/main.ts
+++ b/src/main.ts
@@ -258,7 +258,7 @@ async function getInputs(): Promise<TailscaleConfig> {
   }
 
   const config = {
-    version: core.getInput("version") || "1.94.2",
+    version: parseVersion(core.getInput("version") || "1.94.2"),
     resolvedVersion: "",
     arch: "",
     authKey: authKey,
@@ -287,6 +287,19 @@ async function getInputs(): Promise<TailscaleConfig> {
   return config;
 }
 
+function parseVersion(input: string): string {
+  if (input === versionLatest || input === versionUnstable) {
+    return input;
+  }
+  const version = input.replace(/^v/, "");
+  if (!/^\d+\.\d+\.\d+$/.test(version)) {
+    throw new Error(
+      `Invalid version "${input}": use a version number such as 1.104.2, "latest", or "unstable".`,
+    );
+  }
+  return version;
+}
+
 function validateAuth(config: TailscaleConfig): void {
   if (
     !config.authKey &&