fix: harden semver matching for version tags

.github/workflows/release.yml

@@ -28,8 +28,9 @@ jobs:
         run: |
           set -eu
           git fetch --force --tags origin
+          SEMVER_RE='^(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)$'
 
-          if git tag --points-at "$GITHUB_SHA" | grep -Eq '^[0-9]+\.[0-9]+\.[0-9]+$'; then
+          if git tag --points-at "$GITHUB_SHA" | grep -Eq "$SEMVER_RE"; then
             echo "semver tag already exists on this commit; skipping bump"
             echo "Tag already present on ${GITHUB_SHA}; release build runs from the tag event." >> "$GITHUB_STEP_SUMMARY"
             exit 0
@@ -37,13 +38,13 @@ jobs:
 
           LAST="$(
             git tag --list \
-              | grep -E '^[0-9]+\.[0-9]+\.[0-9]+$' \
+              | grep -E "$SEMVER_RE" \
               | sort -V \
               | tail -n1 || true
           )"
 
           if [ -z "$LAST" ]; then
-            # Baseline requested for the current main line.
+            # Seed semver history at the requested public baseline.
             NEXT="0.9.1"
           else
             MAJOR="${LAST%%.*}"

OpenPuck/webusb_config.cpp

@@ -117,7 +117,7 @@ static void webusbSendBlob()
 	memset(&p[41], 0, 12); // 12B ASCII build ID, NUL-padded
 	{
 		const char *buildId = OPK_BUILD_VERSION;
-		if (buildId[0] == '\0')
+		if (!buildId || buildId[0] == '\0')
 			buildId = OPK_GIT_HASH;
 		for (uint8_t i = 0; i < 12 && buildId[i]; i++)
 			p[41 + i] = (uint8_t)buildId[i];

gen_version.sh

@@ -9,9 +9,10 @@ cd "$(dirname "$0")"
 HASH=$(git rev-parse --short=8 HEAD 2>/dev/null || echo unknown)
 VERSION="${OPK_BUILD_VERSION:-}"
 if [ -z "$VERSION" ]; then
+	SEMVER_RE='^(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)$'
 	VERSION="$(
 		git tag --points-at HEAD 2>/dev/null \
-			| grep -E '^[0-9]+\.[0-9]+\.[0-9]+$' \
+			| grep -E "$SEMVER_RE" \
 			| sort -V \
 			| tail -n1 || true
 	)"