Merge pull request #6150 from mozilla/MNTOR-5023

fix: add input validation for production deployment workflow

Author: mansaj

.github/workflows/production_deploy.yml

@@ -18,6 +18,7 @@ on:
         description: 'The original image tag that has been deployed'
         required: true
         type: string
+        pattern: '^[a-f0-9]{7,12}$'
 jobs:
   pull_retag_push:
     name: Pull, Retag, and Push Images
@@ -31,6 +32,7 @@ jobs:
       GAR_IMAGE_BASE: ${{ vars.GAR_REPO }}/${{ github.event.repository.name }}
       GAR_REGISTRY: us-docker.pkg.dev # Define GAR registry hostname
       DOCKERHUB_IMAGE: mozilla/blurts-server # Define Docker Hub image name
+      SAFE_IMAGE_TAG: ${{ inputs.originalImageTag }}
     steps:
       - name: Checkout Repository
         uses: actions/checkout@v5
@@ -60,19 +62,19 @@ jobs:
           password: ${{ steps.gcp-auth.outputs.access_token }}
 
       - name: Pull Docker Hub image
-        run: docker pull ${{ env.DOCKERHUB_IMAGE }}:${{ inputs.originalImageTag }}
+        run: docker pull "${{ env.DOCKERHUB_IMAGE }}:${{ env.SAFE_IMAGE_TAG }}"
 
       - name: Retag Docker Hub image
-        run: docker tag ${{ env.DOCKERHUB_IMAGE }}:${{ inputs.originalImageTag }} ${{ env.DOCKERHUB_IMAGE }}:${{ inputs.environment }}-${{ inputs.originalImageTag }}
+        run: docker tag "${{ env.DOCKERHUB_IMAGE }}:${{ env.SAFE_IMAGE_TAG }}" "${{ env.DOCKERHUB_IMAGE }}:${{ inputs.environment }}-${{ env.SAFE_IMAGE_TAG }}"
 
       - name: Push Docker Hub image
-        run: docker push ${{ env.DOCKERHUB_IMAGE }}:${{ inputs.environment }}-${{ inputs.originalImageTag }}
+        run: docker push "${{ env.DOCKERHUB_IMAGE }}:${{ inputs.environment }}-${{ env.SAFE_IMAGE_TAG }}"
 
       - name: Pull GAR image
-        run: docker pull ${{ env.GAR_IMAGE_BASE }}:${{ inputs.originalImageTag }}
+        run: docker pull "${{ env.GAR_IMAGE_BASE }}:${{ env.SAFE_IMAGE_TAG }}"
 
       - name: Retag GAR image
-        run: docker tag ${{ env.GAR_IMAGE_BASE }}:${{ inputs.originalImageTag }} ${{ env.GAR_IMAGE_BASE }}:${{ inputs.environment }}-${{ inputs.originalImageTag }}
+        run: docker tag "${{ env.GAR_IMAGE_BASE }}:${{ env.SAFE_IMAGE_TAG }}" "${{ env.GAR_IMAGE_BASE }}:${{ inputs.environment }}-${{ env.SAFE_IMAGE_TAG }}"
 
       - name: Push GAR image
-        run: docker push ${{ env.GAR_IMAGE_BASE }}:${{ inputs.environment }}-${{ inputs.originalImageTag }}
+        run: docker push "${{ env.GAR_IMAGE_BASE }}:${{ inputs.environment }}-${{ env.SAFE_IMAGE_TAG }}"