From 9de8c8fe260a3472d3b4aa3535f48ce18e2d5da0 Mon Sep 17 00:00:00 2001 From: Jason Naylor Date: Mon, 17 Aug 2026 14:12:36 -0700 Subject: [PATCH] Randomize GITHUB_ENV delimiter in commit-message check Derive the GITHUB_ENV heredoc delimiter from a per-run GUID instead of a fixed marker committed to the repo. gitlint echoes the PR's own commit messages into that block, so a static marker could be reproduced in a commit to close the heredoc early and inject environment variables into later steps. A random delimiter cannot be guessed, so the content stays inert. Co-Authored-By: Claude Opus 4.8 --- .github/workflows/CommitMessage.yml | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/.github/workflows/CommitMessage.yml b/.github/workflows/CommitMessage.yml index 8e8deb891f..9e89f6ff0d 100644 --- a/.github/workflows/CommitMessage.yml +++ b/.github/workflows/CommitMessage.yml @@ -36,10 +36,14 @@ jobs: Set-Content -Path check_results.log -Value $log -NoNewline # Put the results into the job summary Add-Content -Path $env:GITHUB_STEP_SUMMARY -Value $log - # Put the results into a multi-line environment variable to use in the next step - Add-Content -Path $env:GITHUB_ENV -Value 'check_results<<###LINT_DELIMITER###' + # Put the results into a multi-line environment variable to use in the next step. + # $log echoes the PR's own commit messages, so a static heredoc marker could be + # reproduced in a commit to close the block early and inject arbitrary variables. + # A random per-run delimiter cannot be known in advance, so the content is inert. + $delimiter = "LINT_EOF_$([guid]::NewGuid().ToString('N'))" + Add-Content -Path $env:GITHUB_ENV -Value "check_results<<$delimiter" Add-Content -Path $env:GITHUB_ENV -Value $log - Add-Content -Path $env:GITHUB_ENV -Value '###LINT_DELIMITER###' + Add-Content -Path $env:GITHUB_ENV -Value $delimiter # add a comment on the PR if the commit message linting failed - name: Comment on PR if: failure()