Validate portable workspace identifiers

internal/artifacts/publish_identity.go

@@ -39,6 +39,9 @@ func ResolvePublishSessionPrefix(cfg *config.Config, m *manifest.Manifest) (stri
 	if cfg.Pipeline.Storage.S3 == nil {
 		return "", fmt.Errorf("pipeline.storage.s3 configuration is required")
 	}
+	if err := ValidateSessionIdentity(campaign, sessionID); err != nil {
+		return "", err
+	}
 
 	sessionPrefix := S3SessionPrefix(cfg.Pipeline.Storage.S3.RootPrefix, campaign, sessionID)
 	if strings.TrimSpace(sessionPrefix) == "" {
@@ -68,6 +71,9 @@ func ResolvePublishRunPrefix(cfg *config.Config, m *manifest.Manifest) (string,
 	if runID == "" {
 		return "", fmt.Errorf("run id is required")
 	}
+	if err := ValidateRunIdentity(runID); err != nil {
+		return "", err
+	}
 	return S3RunPrefix(sessionPrefix, runID), nil
 }