From 0ddf3fc10f5a81197968de819efe9c0bd8863618 Mon Sep 17 00:00:00 2001
From: Mick Grove <mick.grove@mongodb.com>
Date: Mon, 16 Feb 2026 07:34:32 -0800
Subject: [PATCH] Fixes in response to PR review

---
 .github/workflows/pypi.yml | 10 ++++++++--
 tests/cli.rs               |  2 +-
 2 files changed, 9 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/pypi.yml b/.github/workflows/pypi.yml
index 6c21d2e..330c120 100644
--- a/.github/workflows/pypi.yml
+++ b/.github/workflows/pypi.yml
@@ -30,14 +30,20 @@ jobs:
       - name: Determine version/tag
         id: version
         shell: bash
+        env:
+          INPUT_TAG: ${{ github.event.inputs.tag || '' }}
         run: |
           set -euo pipefail
-          if [[ "${GITHUB_EVENT_NAME}" == "workflow_dispatch" && -n "${{ github.event.inputs.tag }}" ]]; then
-            TAG="${{ github.event.inputs.tag }}"
+          if [[ "${GITHUB_EVENT_NAME}" == "workflow_dispatch" && -n "${INPUT_TAG}" ]]; then
+            TAG="${INPUT_TAG}"
           else
             VERSION=$(grep -m1 '^version\s*=' Cargo.toml | cut -d '"' -f2)
             TAG="v${VERSION}"
           fi
+          if [[ ! "${TAG}" =~ ^v[0-9A-Za-z._+-]+$ ]]; then
+            echo "Invalid tag format: ${TAG}" >&2
+            exit 1
+          fi
           VERSION="${TAG#v}"
           echo "tag=${TAG}" >> "$GITHUB_OUTPUT"
           echo "version=${VERSION}" >> "$GITHUB_OUTPUT"
diff --git a/tests/cli.rs b/tests/cli.rs
index 3f8323e..5e9e86f 100644
--- a/tests/cli.rs
+++ b/tests/cli.rs
@@ -59,6 +59,6 @@ mod test {
 
         let html = fs::read_to_string(&output_html).expect("html report should be written");
         assert!(html.contains("Kingfisher Audit Report"));
-        assert!(html.contains("Audit Metadata"));
+        assert!(html.contains("Scan Summary"));
     }
 }