From 988259d0b2694d8f45e2efefd8d4faa668f5a0c1 Mon Sep 17 00:00:00 2001
From: Tim Pohlmann <tim.pohlmann@sonarsource.com>
Date: Fri, 10 Jul 2026 16:33:22 +0200
Subject: [PATCH 1/2] Validate build number before export

The "Export build number" step reads .build_number.txt and exports it
as BUILD_NUMBER unconditionally, on all three code paths (env
passthrough, cache hit, freshly generated) - unlike
get_build_number.sh, which validates the value with the same regex
before incrementing it, but only on the freshly-generated path. A
cache entry with unexpected/corrupted content would flow straight
through to BUILD_NUMBER unchecked.

Found while investigating sonar-scanner-msbuild's CI migration: an
empty BUILD_NUMBER there causes scripts/set-version.ps1 to treat the
run as a release-version bump, checking out a branch, committing, and
opening a PR - an unattended side effect disproportionate to a missing
one-line check.
---
 get-build-number/action.yml | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/get-build-number/action.yml b/get-build-number/action.yml
index c15124d8..c3314944 100644
--- a/get-build-number/action.yml
+++ b/get-build-number/action.yml
@@ -71,6 +71,10 @@ runs:
       shell: bash
       run: |
         BUILD_NUMBER=$(cat "$BUILD_NUMBER_FILE")
+        if ! [[ "$BUILD_NUMBER" =~ ^[0-9]+$ ]]; then
+          echo "::error title=Invalid build number::Build number '${BUILD_NUMBER}' (from ${BUILD_NUMBER_FILE}) is not a valid positive integer." >&2
+          exit 1
+        fi
         echo "BUILD_NUMBER: ${BUILD_NUMBER}"
         echo "BUILD_NUMBER=${BUILD_NUMBER}" >> "$GITHUB_ENV"
         echo "BUILD_NUMBER=${BUILD_NUMBER}" >> "$GITHUB_OUTPUT"

From a610142a1529b58b7965c384f128ab67245e394b Mon Sep 17 00:00:00 2001
From: Tim Pohlmann <tim.pohlmann@sonarsource.com>
Date: Fri, 10 Jul 2026 16:51:54 +0200
Subject: [PATCH 2/2] Shorten error message to satisfy yamllint line-length

---
 get-build-number/action.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/get-build-number/action.yml b/get-build-number/action.yml
index c3314944..b576da1b 100644
--- a/get-build-number/action.yml
+++ b/get-build-number/action.yml
@@ -72,7 +72,7 @@ runs:
       run: |
         BUILD_NUMBER=$(cat "$BUILD_NUMBER_FILE")
         if ! [[ "$BUILD_NUMBER" =~ ^[0-9]+$ ]]; then
-          echo "::error title=Invalid build number::Build number '${BUILD_NUMBER}' (from ${BUILD_NUMBER_FILE}) is not a valid positive integer." >&2
+          echo "::error title=Invalid build number::Build number '${BUILD_NUMBER}' is not a valid positive integer." >&2
           exit 1
         fi
         echo "BUILD_NUMBER: ${BUILD_NUMBER}"