From dadcf1c5ce80db5e14ca50a5361b62ab9a7865a5 Mon Sep 17 00:00:00 2001
From: Adam Moussa <adam@seahavenind.com>
Date: Mon, 28 Sep 2026 16:40:23 -0400
Subject: [PATCH] fix(infra): pin FileBrowser version to a release tag
 (PLAT-77)

The version is interpolated into the boot script. Reject anything that is not a vX.Y.Z tag.
---
 terraform/variables.tf | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/terraform/variables.tf b/terraform/variables.tf
index 48cda43..d2d4b2f 100644
--- a/terraform/variables.tf
+++ b/terraform/variables.tf
@@ -14,6 +14,11 @@ variable "filebrowser_version" {
   description = "Pinned FileBrowser release. Do not track releases/latest."
   type        = string
   default     = "v2.63.23"
+
+  validation {
+    condition     = can(regex("^v[0-9]+\\.[0-9]+\\.[0-9]+$", var.filebrowser_version))
+    error_message = "filebrowser_version must look like v2.63.23."
+  }
 }
 
 variable "smb_password_secret_arn" {