fix(ci): harden plist version validation and use release date for Flatpak

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: lklimek

.github/workflows/flatpak.yml

@@ -44,8 +44,10 @@ jobs:
             echo "::error::Failed to extract version from Cargo.toml"
             exit 1
           fi
-          # Use tag date for releases, current date for manual/PR builds
-          if [ "${{ github.ref_type }}" = "tag" ]; then
+          # Use release published date when available, tag commit date for tag pushes, current date otherwise
+          if [ -n "${{ github.event.release.published_at }}" ]; then
+            DATE=$(echo "${{ github.event.release.published_at }}" | cut -dT -f1)
+          elif [ "${{ github.ref_type }}" = "tag" ]; then
             DATE=$(git log -1 --format=%cs "${{ github.ref }}")
           else
             DATE=$(date +%Y-%m-%d)

.github/workflows/release.yml

@@ -179,8 +179,12 @@ jobs:
             echo "::error::Failed to extract version from Cargo.toml"
             exit 1
           fi
-          # Strip prerelease suffix for macOS plist (Apple requires numeric-only)
-          PLIST_VERSION=$(echo "$VERSION" | sed 's/-.*//')
+          # Strip prerelease and build metadata suffixes for macOS plist (Apple requires numeric-only)
+          PLIST_VERSION=$(echo "$VERSION" | sed 's/[-+].*//')
+          if ! echo "$PLIST_VERSION" | grep -Eq '^[0-9]+(\.[0-9]+){0,2}$'; then
+            echo "::error::Invalid plist version '$PLIST_VERSION' derived from Cargo version '$VERSION'. Expected numeric x[.y[.z]]."
+            exit 1
+          fi
           echo "version=$VERSION" >> $GITHUB_OUTPUT
           echo "plist_version=$PLIST_VERSION" >> $GITHUB_OUTPUT
           echo "Extracted version: $VERSION (plist: $PLIST_VERSION)"
@@ -490,8 +494,12 @@ jobs:
             echo "::error::Failed to extract version from Cargo.toml"
             exit 1
           fi
-          # Strip prerelease suffix for macOS plist (Apple requires numeric-only)
-          PLIST_VERSION=$(echo "$VERSION" | sed 's/-.*//')
+          # Strip prerelease and build metadata suffixes for macOS plist (Apple requires numeric-only)
+          PLIST_VERSION=$(echo "$VERSION" | sed 's/[-+].*//')
+          if ! echo "$PLIST_VERSION" | grep -Eq '^[0-9]+(\.[0-9]+){0,2}$'; then
+            echo "::error::Invalid plist version '$PLIST_VERSION' derived from Cargo version '$VERSION'. Expected numeric x[.y[.z]]."
+            exit 1
+          fi
           echo "version=$VERSION" >> $GITHUB_OUTPUT
           echo "plist_version=$PLIST_VERSION" >> $GITHUB_OUTPUT
           echo "Extracted version: $VERSION (plist: $PLIST_VERSION)"