Harden CLI lane filtering and diagnostics redaction

internal/cli/run.go

@@ -98,6 +98,11 @@ func runConfigValidate(args []string, stdout, stderr io.Writer, opts Options) in
 		fmt.Fprintln(stderr, "notarius: --only requires --pipeline")
 		return 2
 	}
+	only, err := parseOnly(*onlyRaw)
+	if err != nil {
+		fmt.Fprintf(stderr, "notarius: %v\n", err)
+		return 2
+	}
 
 	cfg, path, err := loadConfig(*configPath, opts)
 	if err != nil {
@@ -108,7 +113,7 @@ func runConfigValidate(args []string, stdout, stderr io.Writer, opts Options) in
 	if strings.TrimSpace(*pipelineID) != "" {
 		if _, err := cfg.Resolve(config.ResolveInput{
 			PipelineID: *pipelineID,
-			Only:       parseOnly(*onlyRaw),
+			Only:       only,
 			Catalog:    opts.Catalog,
 		}); err != nil {
 			fmt.Fprintf(stderr, "notarius: %v\n", err)
@@ -239,18 +244,20 @@ func requireConfigFile(path string) error {
 	return nil
 }
 
-func parseOnly(raw string) []string {
+func parseOnly(raw string) ([]string, error) {
 	if strings.TrimSpace(raw) == "" {
-		return nil
+		return nil, nil
 	}
 	parts := strings.Split(raw, ",")
 	result := make([]string, 0, len(parts))
 	for _, part := range parts {
-		if trimmed := strings.TrimSpace(part); trimmed != "" {
-			result = append(result, trimmed)
+		trimmed := strings.TrimSpace(part)
+		if trimmed == "" {
+			return nil, fmt.Errorf("--only must contain comma-separated non-empty artifact lane IDs")
 		}
+		result = append(result, trimmed)
 	}
-	return result
+	return result, nil
 }
 
 func sortedPipelineIDs(cfg config.Config) []string {