dev-lead: multiline INTENT_BODY corrupts $GITHUB_ENV (fails on multiline bot/review comments) #559

Parent: #495 · Work type: Fix · Found by post-implementation health check (#557/#535 rollout).

Symptom

dev-lead-reusable.yml fails at the Parse intent context fields step whenever it is triggered by a multiline comment/review body (e.g. CodeRabbit review comments). Observed on ContentTwin dev-lead run 27307983783 (pull_request_review_comment), but the bug is in the shared reusable (dev-lead/stable = v1.2.0), so it affects every repo running dev-lead.

##[error]Unable to process file command 'env' successfully.
##[error]Invalid format '**Use `@v1` tag literal to satisfy the org workflow standard.**'

Root cause

The step writes the comment body to $GITHUB_ENV with a plain KEY=value line:

echo "INTENT_BODY=$(echo "$ctx" | jq -r '.body // ""')" >> "$GITHUB_ENV"

A multiline value writes additional lines into the env file; the body's 2nd+ lines are parsed as (invalid) env entries → the step fails. Introduced with the INTENT_BODY addition in #488.

Fix

Write INTENT_BODY using the randomized heredoc-delimiter form GitHub recommends for multiline env values (random delimiter so a crafted body can't inject extra env vars). The single-line fields (pr_number, head_sha, etc.) are unaffected.

Rollout

Fix → cut dev-lead/v1.2.1 → promote dev-lead/stable (exercises the release runbook). Validate on a real multiline-comment pickup.

Related

• Secondary health-check finding (separate, lower priority): markets pr-review intermittently picks up the fine-grained PAT on pull_request events and the auth-scope guard fails (self-recovers). To be filed separately.
• The CodeRabbit comment that triggered this advises @v1 — the standard being replaced by feat(standards): all reusable workflows pin the moving stable channel tag .github#440.