Randomize GITHUB_ENV delimiter in commit-message check

[jasonleenaylor]

What

The Commit messages check workflow wrote gitlint output into a GITHUB_ENV multi-line variable using a fixed heredoc delimiter (###LINT_DELIMITER###) that is committed to the repo. This replaces it with a per-run random delimiter derived from a GUID.

-        Add-Content -Path $env:GITHUB_ENV -Value 'check_results<<###LINT_DELIMITER###'
-        Add-Content -Path $env:GITHUB_ENV -Value $log
-        Add-Content -Path $env:GITHUB_ENV -Value '###LINT_DELIMITER###'
+        $delimiter = "LINT_EOF_$([guid]::NewGuid().ToString('N'))"
+        Add-Content -Path $env:GITHUB_ENV -Value "check_results<<$delimiter"
+        Add-Content -Path $env:GITHUB_ENV -Value $log
+        Add-Content -Path $env:GITHUB_ENV -Value $delimiter

Why it matters

gitlint echoes the PR's own commit messages into that output. Because the delimiter was a static, publicly-known string, a crafted commit message containing a line equal to the delimiter could close the heredoc early and append attacker-chosen NAME=value lines to GITHUB_ENV — injecting arbitrary environment variables into the job. The PR is checked out on disk (fetch-depth: 0) and a later step runs a Node action, so an injected NODE_OPTIONS (or similar) is a plausible path to code execution on the runner. This is the exact class of bug GitHub's random-delimiter guidance for GITHUB_ENV is meant to prevent.

A per-run GUID delimiter cannot be predicted or reproduced in commit content, so the multi-line value stays inert regardless of what the commit messages contain.

Scope / validation

• One file: .github/workflows/CommitMessage.yml.
• YAML validated with a parser. Behavior is unchanged for legitimate input — same variable name, same consumer, same PR comment.

---

This is one of two PRs from a GitHub Actions security audit. The other PR (least-privilege permissions: blocks) also edits CommitMessage.yml, but in a different region (top of file), so the two merge independently.

---

This change is 

[github-actions]

NUnit Tests

    1 files      1 suites   11m 40s ⏱️
5 778 tests 5 697 ✅ 81 💤 0 ❌
5 787 runs  5 706 ✅ 81 💤 0 ❌

Results for commit 9de8c8f.

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 38.06%. Comparing base (08a02fd) to head (9de8c8f).
⚠️ Report is 1 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff            @@
##           main    #1073       +/-   ##
=========================================
+ Coverage      0   38.06%   +38.06%     
=========================================
  Files         0     1499     +1499     
  Lines         0   350146   +350146     
  Branches      0    40239    +40239     
=========================================
+ Hits          0   133296   +133296     
- Misses        0   187572   +187572     
- Partials      0    29278    +29278     

see 1499 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.