fix: shell quote leak in release-go workflow target passing

.github/workflows/release-go.yml

@@ -63,37 +63,31 @@ jobs:
       - name: Release
         id: release
         run: |
-          args=""
+          ARGS=()
 
           if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
             if [ "${{ inputs.targets }}" != "all" ]; then
-              args="$args --targets '${{ inputs.targets }}'"
+              ARGS+=("--targets" "${{ inputs.targets }}")
             fi
             if [ "${{ inputs.force }}" = "true" ]; then
-              args="$args --force"
+              ARGS+=("--force")
             fi
             if [ "${{ inputs.no_push }}" = "true" ]; then
-              args="$args --no-push"
+              ARGS+=("--no-push")
             fi
             if [ "${{ inputs.verbose }}" = "true" ]; then
-              args="$args --verbose"
+              ARGS+=("--verbose")
             fi
             if [ "${{ inputs.dry_run }}" = "true" ]; then
-              args="$args --dry-run"
+              ARGS+=("--dry-run")
             fi
             if [ "${{ inputs.validate_only }}" = "true" ]; then
-              args="$args --validate-only"
-            fi
-            if [ "${{ inputs.force }}" = "true" ]; then
-              args="$args --force"
-            fi
-            if [ "${{ inputs.no_push }}" = "true" ]; then
-              args="$args --no-push"
+              ARGS+=("--validate-only")
             fi
           fi
 
-          echo "Running: python scripts/release-go.py $args"
-          python scripts/release-go.py $args
+          echo "Running: python scripts/release-go.py ${ARGS[*]}"
+          python scripts/release-go.py "${ARGS[@]}"
 
       - name: Get modified apps info
         id: get_modified_apps

scripts/release-go.py

@@ -878,7 +878,7 @@ def filter_targets(registry: BuildRegistry, target_filter: str) -> List[BuildTar
         logger.info(f"Available targets: {sorted(registry.targets.keys())}")
         return list(registry.targets.values())
 
-    requested_targets = [t.strip() for t in target_filter.split(",")]
+    requested_targets = [t.strip().strip('\'"') for t in target_filter.split(",")]
     filtered_targets = []
 
     for target_name in requested_targets: