workflows/release-sources: Validate input and remove template expansion (llvm#199426)

https://github.com/llvm/llvm-project/security/code-scanning/1730
https://github.com/llvm/llvm-project/security/code-scanning/1731
https://github.com/llvm/llvm-project/security/code-scanning/1732
https://github.com/llvm/llvm-project/security/code-scanning/1733

Author: tstellar

.github/workflows/release-sources.yml

@@ -50,15 +50,22 @@ jobs:
       export-args: ${{ steps.inputs.outputs.export-args }}
     runs-on: ubuntu-24.04
     steps:
+      - name: Validate Input
+        if: inputs.release-version != ''
+        uses: ./.github/workflows/validate-release-version
+        with:
+          release-version: ${{ inputs.release-version }}
       - id: inputs
+        env:
+          REF: ${{ (inputs.release-version && format('llvmorg-{0}', inputs.release-version)) || github.sha }}
+          INPUTS_RELEASE_VERSION: ${{ inputs.release-version }}
         run: |
-          ref=${{ (inputs.release-version && format('llvmorg-{0}', inputs.release-version)) || github.sha }}
-          if [ -n "${{ inputs.release-version }}" ]; then
-            export_args="-release ${{ inputs.release-version }} -final"
+          if [ -n "$INPUTS_RELEASE_VERSION" ]; then
+            export_args="-release $INPUTS_RELEASE_VERSION -final"
           else
             export_args="-git-ref ${{ github.sha }}"
           fi
-          echo "ref=$ref" >> $GITHUB_OUTPUT
+          echo "ref=$REF" >> $GITHUB_OUTPUT
           echo "export-args=$export_args" >> $GITHUB_OUTPUT
 
   release-sources:
@@ -82,8 +89,10 @@ jobs:
           pip install --require-hashes -r ./llvm/utils/git/requirements.txt
 
       - name: Create Tarballs
+        env:
+          EXPORT_ARGS: ${{ needs.inputs.outputs.export-args }}
         run: |
-          ./llvm/utils/release/export.sh ${{ needs.inputs.outputs.export-args }}
+          ./llvm/utils/release/export.sh $EXPORT_ARGS
 
       - name: Generate sha256 digest for sources
         id: digest