fix: prevent Node.js upgrade workflow from creating PRs with empty versions

[salmanmkc]

Fix broken Node.js upgrade workflow

The automated Node upgrade workflow has been creating useless PRs like this one: #4050

The problem was that it was looking for the wrong release tag format in the alpine_nodejs repo and ended up with empty version strings.

What was broken

The workflow assumed alpine_nodejs releases were tagged like node20-20.19.5 but they're actually just v20.19.5. So when it tried to fall back to alpine releases, the grep patterns failed and we got empty strings.

Result: PRs showing "Node 20: 20.19.5 → " with nothing after the arrow.

What I fixed

1. Fixed the tag patterns - Changed from looking for ^node20- to ^v20\. which actually matches the real tags
2. Added validation - Now it checks that versions aren't empty and match the expected x.y.z format before doing anything
3. Better error handling - If something goes wrong, it shows you what releases are actually available instead of silently failing
4. Verification - Double-checks that the file updates actually worked

Testing

Ran the grep patterns manually against the real alpine_nodejs releases and confirmed they work:

• v20.19.5, v24.8.0 etc. are correctly parsed to 20.19.5, 24.8.0
• Validation correctly rejects empty strings and malformed versions

This should prevent any more broken automation PRs and make debugging easier when things do go wrong.

[Copilot]

Pull Request Overview

This PR fixes a broken automated Node.js upgrade workflow that was creating PRs with empty version strings due to incorrect release tag pattern matching. The workflow was looking for node20-X.Y.Z format tags but the alpine_nodejs repository actually uses vX.Y.Z format.

Key changes:

• Fixed grep patterns to match actual alpine_nodejs release tag format (^vX.Y.Z instead of ^nodeX-)
• Added comprehensive validation to prevent empty or malformed version strings
• Enhanced error handling with better diagnostics when version detection fails

[Copilot]

The condition [ -z \"$LATEST_NODE20\" ] || [ \"$LATEST_NODE20\" = \"\" ] is redundant. The -z test already checks for empty strings, so the || [ \"$LATEST_NODE20\" = \"\" ] part is unnecessary and can be removed.

Suggested change

	if [ -z "$LATEST_NODE20" ] || [ "$LATEST_NODE20" = "" ]; then
	echo "::error title=Invalid Node 20 Version::Failed to determine valid Node 20 version. Got: '$LATEST_NODE20'"
	echo "Available alpine_nodejs releases:"
	echo "$ALPINE_RELEASES" | head -10
	exit 1
	fi
	if [ -z "$LATEST_NODE24" ] || [ "$LATEST_NODE24" = "" ]; then
	if [ -z "$LATEST_NODE20" ]; then
	echo "::error title=Invalid Node 20 Version::Failed to determine valid Node 20 version. Got: '$LATEST_NODE20'"
	echo "Available alpine_nodejs releases:"
	echo "$ALPINE_RELEASES" | head -10
	exit 1
	fi
	if [ -z "$LATEST_NODE24" ]; then

[Copilot]

The condition [ -z \"$LATEST_NODE24\" ] || [ \"$LATEST_NODE24\" = \"\" ] is redundant. The -z test already checks for empty strings, so the || [ \"$LATEST_NODE24\" = \"\" ] part is unnecessary and can be removed.

Suggested change

	if [ -z "$LATEST_NODE20" ] || [ "$LATEST_NODE20" = "" ]; then
	echo "::error title=Invalid Node 20 Version::Failed to determine valid Node 20 version. Got: '$LATEST_NODE20'"
	echo "Available alpine_nodejs releases:"
	echo "$ALPINE_RELEASES" | head -10
	exit 1
	fi
	if [ -z "$LATEST_NODE24" ] || [ "$LATEST_NODE24" = "" ]; then
	if [ -z "$LATEST_NODE20" ]; then
	echo "::error title=Invalid Node 20 Version::Failed to determine valid Node 20 version. Got: '$LATEST_NODE20'"
	echo "Available alpine_nodejs releases:"
	echo "$ALPINE_RELEASES" | head -10
	exit 1
	fi
	if [ -z "$LATEST_NODE24" ]; then

[Copilot]

Changing from << 'EOF' to << EOF enables variable expansion in the heredoc, which is necessary for the variables to be substituted. However, this makes the heredoc vulnerable to shell injection if the variables contain special characters. Consider using proper escaping or validation of the variables before using them in the heredoc.

See below for a potential fix:

          # Sanitize variables to prevent shell injection in heredoc
          safe_NODE20_VERSION=$(printf '%s' "$NODE20_VERSION" | tr -d '\n' | sed 's/"/\\"/g')
          safe_NODE24_VERSION=$(printf '%s' "$NODE24_VERSION" | tr -d '\n' | sed 's/"/\\"/g')

          # Create PR body using here-doc for proper formatting
          cat > pr_body.txt << EOF
          Automated Node.js version update:

          - Node 20: ${{ steps.node-versions.outputs.current_node20 }} → $safe_NODE20_VERSION
          - Node 24: ${{ steps.node-versions.outputs.current_node24 }} → $safe_NODE24_VERSION