From 5f7092e0296414dae19f5570e681e333958c3e41 Mon Sep 17 00:00:00 2001
From: Danny Avila <danny@librechat.ai>
Date: Thu, 14 May 2026 09:24:34 -0400
Subject: [PATCH] =?UTF-8?q?=F0=9F=8F=B7=EF=B8=8F=20fix:=20Harden=20Helm=20?=
 =?UTF-8?q?Chart=20Tag=20Parsing=20(#13123)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .github/workflows/helmcharts.yml | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/helmcharts.yml b/.github/workflows/helmcharts.yml
index 2b9f7f45de..b76f088776 100644
--- a/.github/workflows/helmcharts.yml
+++ b/.github/workflows/helmcharts.yml
@@ -37,8 +37,15 @@ jobs:
 
       - name: Get Chart Version
         id: chart-version
+        env:
+          REF_NAME: ${{ github.ref_name }}
         run: |
-          CHART_VERSION=$(echo "${{ github.ref_name }}" | cut -d'-' -f2)
+          CHART_VERSION="${REF_NAME#chart-}"
+          SEMVER_REGEX='^[0-9]+\.[0-9]+\.[0-9]+(-[0-9A-Za-z.-]+)?(\+[0-9A-Za-z.-]+)?$'
+          if [[ ! "$CHART_VERSION" =~ $SEMVER_REGEX ]]; then
+            echo "Invalid chart version: $CHART_VERSION" >&2
+            exit 1
+          fi
           echo "CHART_VERSION=${CHART_VERSION}" >> "$GITHUB_OUTPUT"
 
       # Log in to GitHub Container Registry
@@ -72,4 +79,4 @@ jobs:
           path: helm/librechat-rag-api
           registry: ghcr.io
           registry_username: ${{ github.actor }}
-          registry_password: ${{ secrets.GITHUB_TOKEN }}
\ No newline at end of file
+          registry_password: ${{ secrets.GITHUB_TOKEN }}