build: refuse an empty package folder list, and validate its characters

Removing the literal quotes changed one failure mode for the worse. If the
gawk matches nothing, the prefix is empty; build-tools splits on ", " and
matches with startswith(), and "".startswith("") is True, so every folder
becomes a package (module_name came out as 'docs'). Previously the empty
value reached an unquoted ${{ }} and click failed on the missing argument,
which at least stopped the build. Fail loudly instead.

The character check covers the part quoting cannot: ${{ }} splices the
value into the run: block as text before any shell parses it, so a folder
name containing a quote or backtick escapes the quotes added around the
expansion. Restricting the list to what a module name can contain closes
that, rather than relying on the quotes.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Author: tyeth

.github/workflows/release.yml

@@ -35,11 +35,27 @@ jobs:
     - name: Package Folder Prefix For circuitpython-build-tools (Community Bundle Specific)
       id: pkg-folder
       run: |
-        echo prefix=$(
+        prefix=$(
         ls -RUx |
         gawk -F '\n' '{ match($1, /(drivers|helpers)\/(.+)\/(.+)\:/, arr) ; if (length(arr[0]) > 0 && match(arr[3], arr[2]) > 0) printf "%s, ", arr[3] }' |
         gawk '{ print substr($0, 1, length($0) - 2) }'
-        ) >> $GITHUB_OUTPUT
+        )
+        # An empty list is never correct: build-tools splits on ", " and matches
+        # with startswith(), and "".startswith("") is True, so an empty prefix
+        # would silently make every folder -- docs/, tests/, ci/ -- a package.
+        if [ -z "$prefix" ]; then
+          echo "::error::no package folders matched under libraries/; refusing to build an empty bundle"
+          exit 1
+        fi
+        # ${{ }} splices this into the later run: block as text, before any shell
+        # sees it, so the quotes there cannot contain a folder name carrying a
+        # quote or a backtick. Allow only what a module name can be.
+        case "$prefix" in
+          *[!A-Za-z0-9_, -]*)
+            echo "::error::unexpected character in package folder list: $prefix"
+            exit 1 ;;
+        esac
+        echo "prefix=$prefix" >> "$GITHUB_OUTPUT"
     - name: Build assets
       run: circuitpython-build-bundles --filename_prefix ${{ steps.repo-name.outputs.repo-name }} --library_location libraries --library_depth 2 --package_folder_prefix "${{ steps.pkg-folder.outputs.prefix }}"
     - name: Upload Release Assets

build.sh

@@ -32,4 +32,9 @@ gawk -F '\n' '{ match($1, /(drivers|helpers)\/(.+)\/(.+)\:/, arr) ; if (length(a
 gawk '{ print substr($0, 1, length($0) - 2) }'
 )
 
+if [ -z "$P" ]; then
+    echo "error: no package folders matched under libraries/; refusing to build an empty bundle" >&2
+    exit 1
+fi
+
 circuitpython-build-bundles --filename_prefix circuitpython-community-bundle --library_location libraries --library_depth 2 --package_folder_prefix "$P"