feat: add validation for module and namespace names (#359)

Closes #

## Description

add validation for module and namespace names to ensure they contain
only alphanumeric characters and hyphens
<!-- Briefly describe what this PR does and why -->

## Type of Change

- [ ] New module
- [ ] Bug fix
- [X] Feature/enhancement
- [ ] Documentation
- [ ] Other

## Testing & Validation

- [X] Tests pass (`bun test`)
- [X] Code formatted (`bun run fmt`)
- [X] Changes tested locally

---------

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Michael Smith <michaelsmith@coder.com>

cmd/readmevalidation/repostructure.go

@@ -4,6 +4,7 @@ import (
 	"errors"
 	"os"
 	"path"
+	"regexp"
 	"slices"
 	"strings"
 
@@ -12,6 +13,10 @@ import (
 
 var supportedUserNameSpaceDirectories = append(supportedResourceTypes, ".images")
 
+// validNameRe validates that names contain only alphanumeric characters and hyphens
+var validNameRe = regexp.MustCompile(`^[a-zA-Z0-9](?:[a-zA-Z0-9-]*[a-zA-Z0-9])?$`)
+
+
 // validateCoderResourceSubdirectory validates that the structure of a module or template within a namespace follows all
 // expected file conventions
 func validateCoderResourceSubdirectory(dirPath string) []error {
@@ -42,6 +47,12 @@ func validateCoderResourceSubdirectory(dirPath string) []error {
 			continue
 		}
 
+		// Validate module/template name
+		if !validNameRe.MatchString(f.Name()) {
+			errs = append(errs, xerrors.Errorf("%q: name contains invalid characters (only alphanumeric characters and hyphens are allowed)", path.Join(dirPath, f.Name())))
+			continue
+		}
+
 		resourceReadmePath := path.Join(dirPath, f.Name(), "README.md")
 		if _, err := os.Stat(resourceReadmePath); err != nil {
 			if errors.Is(err, os.ErrNotExist) {
@@ -79,6 +90,12 @@ func validateRegistryDirectory() []error {
 			continue
 		}
 
+		// Validate namespace name
+		if !validNameRe.MatchString(nDir.Name()) {
+			allErrs = append(allErrs, xerrors.Errorf("%q: namespace name contains invalid characters (only alphanumeric characters and hyphens are allowed)", namespacePath))
+			continue
+		}
+
 		contributorReadmePath := path.Join(namespacePath, "README.md")
 		if _, err := os.Stat(contributorReadmePath); err != nil {
 			allErrs = append(allErrs, err)