Randomize GITHUB_ENV delimiter in commit-message check (#1073)

Derive the GITHUB_ENV heredoc delimiter from a per-run GUID instead of a
fixed marker committed to the repo. gitlint echoes the PR's own commit
messages into that block, so a static marker could be reproduced in a
commit to close the heredoc early and inject environment variables into
later steps. A random delimiter cannot be guessed, so the content stays
inert.

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

Author: jasonleenaylor

.github/workflows/CommitMessage.yml

@@ -36,10 +36,14 @@ jobs:
         Set-Content -Path check_results.log -Value $log -NoNewline
         # Put the results into the job summary
         Add-Content -Path $env:GITHUB_STEP_SUMMARY -Value $log
-        # Put the results into a multi-line environment variable to use in the next step
-        Add-Content -Path $env:GITHUB_ENV -Value 'check_results<<###LINT_DELIMITER###'
+        # Put the results into a multi-line environment variable to use in the next step.
+        # $log echoes the PR's own commit messages, so a static heredoc marker could be
+        # reproduced in a commit to close the block early and inject arbitrary variables.
+        # A random per-run delimiter cannot be known in advance, so the content is inert.
+        $delimiter = "LINT_EOF_$([guid]::NewGuid().ToString('N'))"
+        Add-Content -Path $env:GITHUB_ENV -Value "check_results<<$delimiter"
         Add-Content -Path $env:GITHUB_ENV -Value $log
-        Add-Content -Path $env:GITHUB_ENV -Value '###LINT_DELIMITER###'
+        Add-Content -Path $env:GITHUB_ENV -Value $delimiter
     # add a comment on the PR if the commit message linting failed
     - name: Comment on PR
       if: failure()