Sanitize version/ref_name for use as docker label

Docker labels/tags can contain only alphanumeric chars, underscores,
periods and hyphens and must start with alphanumeric or underscores. So
we convert all invalid chars to hyphens and strip leading invalid chars.

Technically we do not need to strip the leading chars as we construct
the label with the version as a suffix, but it would look a little weird
if we didn't and allows us to use the version as a pure tag if we want
to later.

.github/workflows/build.yaml

@@ -31,6 +31,7 @@ jobs:
       contents: read
     steps:
       - name: version
+        shell: bash
         env:
           VERSION: ${{ inputs.version }}
           REF_NAME: ${{ github.ref_name }}
@@ -40,6 +41,11 @@ jobs:
             echo "No version or ref_name set" >&2
             exit 1
           fi
+          # Sanitize label to contain only valid chars: alphanumeric, underscore, period, hyphen
+          # Must start with alphanumeric or underscore.
+          shopt -q extglob
+          V="${V//[^A-Za-z0-9_.-]/-}" # convert invalid chars to hyphens
+          V="${V/#*([^A-Za-z0-9_])/}" # strip leading invalid chars (needs `shopt extglob`)
           echo "V=$V" >> "$GITHUB_ENV"
       - name: Assume AWS ECR Push Role
         uses: aws-actions/configure-aws-credentials@010d0da01d0b5a38af31e9c3470dbfdabdecca3a # v4.0.1