fix: Reject malformed dispatcher minimum versions consistently

[hatayama]

Summary

• Ensure dispatcher package pins and release automation validate semantic versions through the shared parser.
• Reject malformed dispatcher minimum versions, including leading-zero values, before freshness checks can silently bypass updates.

User Impact

• Invalid version values in package pins now fail closed consistently across dispatcher and release automation paths.
• Dispatcher update decisions no longer depend on a looser local regex than the comparator used for freshness checks.

Changes

• Add shared version.IsValid for semver validation without self-comparison.
• Replace dispatcher pin regex validation and release automation self-comparison with the shared validator.
• Add regression coverage for leading-zero minimum dispatcher versions and refresh the dispatcher shared input stamp.

Verification

• go test ./version from cli/common
• go test ./internal/dispatcher -run 'TestLoadDispatcherPinRejectsMinimumDispatcherVersionWithLeadingZero|TestLoadDispatcherPinRejectsInvalidMinimumDispatcherVersion|TestLoadDispatcherPinNormalizesVersionPrefixes' from cli/dispatcher
• go test ./internal/automation -run 'TestParseProtocolMinimumVersionValues_WhenMinimumVersionIsInvalid_Fails' from cli/release-automation
• scripts/check-go-cli.sh
• go run ./cmd/check-release-triggers --base origin/v3-beta --head HEAD from cli/release-automation

[coderabbitai]

Warning

Review limit reached

@hatayama, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 29 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 89b7fee7-b96c-4843-ad9a-321aced5b53e

📥 Commits

Reviewing files that changed from the base of the PR and between 0ccd2fb and 0a8c2b6.

📒 Files selected for processing (2)

• cli/common/version/compare.go
• cli/dispatcher/shared-inputs-stamp.json

📝 Walkthrough

Walkthrough

Adds a shared version.IsValid semver validator, updates callers in clitest, dispatcher, update, and release-automation to use it, and extends tests for invalid build metadata and leading-zero versions.

Changes

Shared IsValid validation migration

Layer / File(s)	Summary
IsValid helper and unit tests cli/common/version/compare.go, cli/common/version/compare_test.go	Adds exported IsValid(value string) bool, tightens build-metadata parsing, and adds tests covering valid and invalid semver strings.
clitest validation migration cli/common/clitest/clitest.go	RequireValidContractVersion now calls version.IsValid(value) instead of comparing a value to itself.
Dispatcher pin validation migration cli/dispatcher/internal/dispatcher/dispatcher_pin.go, cli/dispatcher/internal/dispatcher/dispatcher_test.go	Removes the local regexp pattern, imports sharedversion, switches validateDispatcherProjectRunnerVersion to sharedversion.IsValid, and adds rejection tests for invalid build metadata and leading-zero versions.
Update command and release-automation migration cli/dispatcher/internal/update/command.go, cli/release-automation/internal/automation/protocol_minimum_version_parse.go, cli/dispatcher/shared-inputs-stamp.json	IsValidTargetVersion and ParseProtocolMinimumVersionValues switch to sharedversion.IsValid; the stamp hash is updated.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

• hatayama/unity-cli-loop#1470: Changes the same clitest.RequireValidContractVersion semver validation path that this PR migrates to version.IsValid.
• hatayama/unity-cli-loop#1501: Touches the same dispatcher pin validation path and related semver handling in dispatcher_pin.go.
• hatayama/unity-cli-loop#1506: Modifies the same release-automation minimum version parsing flow in protocol_minimum_version_parse.go.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly summarizes the main change: consistently rejecting malformed dispatcher minimum versions.
Description check	✅ Passed	The description is directly related to the changeset and accurately summarizes the validation updates and tests.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feature/hatayama/unify-semver-validation

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[qua-hatayama]

@cubic-dev-ai review this PR after the latest commit.

[cubic-dev-ai]

@cubic-dev-ai review this PR after the latest commit.

@qua-hatayama I have started the AI code review. It will take a few minutes to complete.

[cubic-dev-ai]

No issues found across 8 files

_{Re-trigger cubic}

[coderabbitai]

🧹 Nitpick comments (1)

cli/common/version/compare.go (1)

123-137: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low value

Correctly implements semver build-metadata validation.

Rejects empty/dot-separated-empty identifiers and restricts to alphanumeric+hyphen, matching semver 2.0's build-metadata rules (no leading-zero restriction applies here, unlike prerelease). This closes the path-smuggling gap the tests target (e.g. 3.0.0+../../payload).

One minor observation: isValidBuildMetadata duplicates most of the loop structure in isValidPrerelease (Lines 105-121), differing only by the leading-zero check. Consider extracting a shared identifier-list validator that takes an optional numeric-leading-zero check as a parameter to reduce duplication.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@cli/common/version/compare.go` around lines 123 - 137, `isValidBuildMetadata`
currently duplicates the identifier-splitting logic from `isValidPrerelease`,
making the two validators drift-prone. Refactor the shared loop into a common
helper used by both `isValidBuildMetadata` and `isValidPrerelease`, and
parameterize the leading-zero numeric check so prerelease keeps its restriction
while build metadata skips it. Keep the existing character validation via
`containsOnlyPrereleaseCharacters` and preserve the empty/dot-separated-empty
rejection behavior.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In `@cli/common/version/compare.go`:
- Around line 123-137: `isValidBuildMetadata` currently duplicates the
identifier-splitting logic from `isValidPrerelease`, making the two validators
drift-prone. Refactor the shared loop into a common helper used by both
`isValidBuildMetadata` and `isValidPrerelease`, and parameterize the
leading-zero numeric check so prerelease keeps its restriction while build
metadata skips it. Keep the existing character validation via
`containsOnlyPrereleaseCharacters` and preserve the empty/dot-separated-empty
rejection behavior.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: c4771a92-89d2-4954-b366-1da60208d074

📥 Commits

Reviewing files that changed from the base of the PR and between d91b9ba and 0ccd2fb.

📒 Files selected for processing (4)

• cli/common/version/compare.go
• cli/common/version/compare_test.go
• cli/dispatcher/internal/dispatcher/dispatcher_test.go
• cli/dispatcher/shared-inputs-stamp.json

✅ Files skipped from review due to trivial changes (1)

• cli/dispatcher/shared-inputs-stamp.json

🚧 Files skipped from review as they are similar to previous changes (1)

• cli/common/version/compare_test.go