[don-petry]

Problem (#559)

dev-lead-reusable.yml's Parse intent context fields step writes the comment body to $GITHUB_ENV with a plain KEY=value line. A multiline body (CodeRabbit reviews, etc.) spills its 2nd+ lines into the env file as invalid entries and fails the step — so dev-lead fails on every multiline bot/review-comment pickup, fleet-wide (the bug is in the shared reusable = dev-lead/stable v1.2.0).

##[error]Unable to process file command 'env' successfully.
##[error]Invalid format '**Use `@v1` tag literal...'

Found by the post-implementation health check of the #535/#557 rollout (ContentTwin run 27307983783).

Fix

Write INTENT_BODY with the heredoc form INTENT_BODY<<DELIM … DELIM using a random delimiter (openssl rand -hex 16) so newlines are preserved and a crafted body can't inject extra env vars by embedding the delimiter. Single-line fields unchanged.

Validation

Simulated locally with a multiline CodeRabbit-style body (code fences, @v1, diff block): the value is written as one well-formed multiline env entry, delimiter balanced, nothing spills. YAML parses.

Rollout

On merge: cut dev-lead/v1.2.1 and promote dev-lead/stable (exercises the release runbook). Closes #559.

🤖 Generated with Claude Code

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

[coderabbitai]

Warning

Review limit reached

@don-petry, we couldn't start this review because you've reached your PR review rate limit.

More reviews will be available in 41 minutes and 49 seconds. Learn how PR review limits work.

Your organization has run out of usage credits. Purchase more in the billing tab.

⌛ How to resolve this issue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans include higher PR review limits than trial, open-source, and free plans. In all cases, reviews become available again over time. During sustained high-volume PR review activity, CodeRabbit may temporarily slow when the next review becomes available.

Please see our Fair Usage Limits Policy for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: 005fe53d-9c37-422b-808a-c6c1ad5327e9

📥 Commits

Reviewing files that changed from the base of the PR and between 7932a61 and 7589140.

📒 Files selected for processing (1)

• .github/workflows/dev-lead-reusable.yml

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/dev-lead-intent-body-multiline

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[gemini-code-assist]

Note

Gemini is unable to generate a review for this pull request due to the file types involved not being currently supported.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[Copilot]

Pull request overview

This PR fixes a fleet-wide dev-lead failure in the shared reusable workflow where multiline comment/review bodies were being written to $GITHUB_ENV using KEY=value, causing the env file parser to error on the 2nd+ lines.

Changes:

• Write INTENT_BODY to $GITHUB_ENV using the multiline heredoc form (INTENT_BODY<<DELIM ... DELIM) instead of KEY=value.
• Use a randomized delimiter (openssl rand -hex 16) to preserve newlines and prevent delimiter-injection via crafted comment bodies.

[don-petry]

Dev-Lead — review-changes (no-changes)

No changes were needed for this PR.

[donpetry-bot]

Automated review — APPROVED ✓

Risk: LOW
Reviewed commit: 75891409bf03a434124d65bb83ee002f358d7758
Review mode: triage-approved (single reviewer)

Summary

Fixes a fleet-wide dev-lead failure where multiline comment bodies (e.g. CodeRabbit reviews) spilled into $GITHUB_ENV and broke the Parse intent context fields step. The fix swaps the plain KEY=value write for the GitHub-recommended heredoc form with a randomized delimiter from openssl rand -hex 16, preserving newlines and preventing crafted bodies from injecting extra env vars.

Linked issue analysis

Closes #559 directly. Issue body identifies the same root cause (multiline body written as KEY=value to $GITHUB_ENV) and prescribes exactly this fix (randomized heredoc delimiter per GitHub docs). Single-line fields are correctly left unchanged. PR validation describes a local repro with a CodeRabbit-style multiline body. Rollout plan (cut dev-lead/v1.2.1, promote dev-lead/stable) matches the issue.

Findings

• Pattern: KEY<<DELIM ... DELIM grouped under { ... } >> "$GITHUB_ENV" is the standard GitHub Actions multiline pattern.
• Delimiter unguessability: 128 bits of entropy from openssl rand -hex 16 is more than sufficient to prevent delimiter-injection from a crafted body.
• Tooling: openssl is preinstalled on ubuntu-latest runners.
• Scope: Only INTENT_BODY is changed; the other single-line fields remain plain echoes, which is correct.
• Termination: printf '%s\\n' on the closing delimiter avoids an unterminated heredoc.
• Comment: The inline comment captures the why (incident, security rationale) without being noisy.
• Not a thin caller stub: dev-lead-reusable.yml is the org-private reusable workflow, so modifying it here is in scope per CLAUDE.md/AGENTS.md.
  No issues found.

CI status

All required checks green: shellcheck, bats, Lint, ShellCheck, Agent Security Scan, Secret scan (gitleaks), CodeQL (actions + python), SonarCloud (Quality Gate passed, 0 new issues), AgentShield, Compile agentic workflows, Test Dev-Lead Agent (validate-fixtures / unit / prompt-coverage / concurrency-config / caller-permissions / toplevel-permissions / stub-structure / dependency-audit-stub), Tests / unit-tests, dev-lead / dispatch. Skipped checks (dependabot-automerge, pr-review-mention, ci-relay, language-specific dependency audits) are expected for this PR shape.

---

Reviewed automatically by the PR-review agent (single-reviewer mode: opus 4.7). Reply if you need a human review.