Harden release validation

scripts/build-release-assets.sh

@@ -7,6 +7,11 @@ script_dir=$(CDPATH= cd "$(dirname "$0")" && pwd -P)
 
 tool_name=build-release-assets
 
+# Release builds always use the tagged module in this repository. Own this
+# setting here so direct callers and CI cannot supply an ambient Go workspace.
+GOWORK=off
+export GOWORK
+
 if [ "$#" -ne 2 ]; then
 	narratio_release_fail "$tool_name" 'usage: scripts/build-release-assets.sh VERSION OUTPUT_DIR'
 fi

scripts/release-lib.sh

@@ -11,32 +11,12 @@ narratio_release_fail() {
 }
 
 narratio_release_validate_version() {
-	version=$1
-	case $version in
-		v*.*.*) ;;
-		*) return 1 ;;
+	case $1 in
+		*'
+'*) return 1 ;;
 	esac
-	components=${version#v}
-	if [ "$components" = "$version" ]; then
-		return 1
-	fi
-
-	previous_ifs=$IFS
-	IFS=.
-	set -- $components
-	IFS=$previous_ifs
-	if [ "$#" -ne 3 ]; then
-		return 1
-	fi
-	for component in "$@"; do
-		case $component in
-			0 | [1-9]*) ;;
-			*) return 1 ;;
-		esac
-		case $component in
-			*[!0-9]*) return 1 ;;
-		esac
-	done
+	printf '%s\n' "$1" |
+		grep -Eq '^v(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)$'
 }
 
 narratio_release_repo_root() (