This is the right direction. Docker tags can contain . and -, but not as the first character, so stripping leading invalid characters matches the existing sanitizer behavior better than rejecting the tag.

One edge case needs tightening before merge: this can now sanitize a non-empty value into an empty tag, for example ..., ---, or /. setVersion() currently checks for empty before calling sanitizeTag(), so an empty sanitized value could become version.main and prevent a later valid tag from becoming the main version.

Could you move the empty check after sanitization?

val = Meta.sanitizeTag(val);
if (val.length == 0) {
  return version;
}

Please also add a focused test for that case, for example a higher-priority raw value that sanitizes to empty followed by a valid raw value, expecting the valid one to become main.

is there something I need to update?

See https://github.com/docker/metadata-action/blob/master/.github/CONTRIBUTING.md#submitting-a-pull-request