ci(desktop): draw the GITHUB_ENV delimiter at random

A credential containing the fixed heredoc marker could close its own value
and let the remainder become separate environment entries.

Author: elkaix

.github/workflows/desktop-release.yml

@@ -144,10 +144,14 @@ jobs:
           IN_APPLE_API_ISSUER: ${{ secrets.APPLE_API_ISSUER }}
           IN_APPLE_API_KEY_P8: ${{ secrets.APPLE_API_KEY_P8 }}
         run: |
+          # A fixed heredoc marker lets a credential that happens to contain that
+          # line close its own value early and turn the rest into environment
+          # entries. Draw the delimiter at random so no secret can carry it.
+          delimiter="EOF_$(openssl rand -hex 16)"
           for name in CSC_LINK CSC_KEY_PASSWORD CSC_NAME APPLE_ID APPLE_APP_SPECIFIC_PASSWORD APPLE_TEAM_ID APPLE_API_KEY_ID APPLE_API_ISSUER; do
             input="IN_${name}"
             value="${!input:-}"
-            if [ -n "$value" ]; then printf '%s<<__EOF__\n%s\n__EOF__\n' "$name" "$value" >> "$GITHUB_ENV"; fi
+            if [ -n "$value" ]; then printf '%s<<%s\n%s\n%s\n' "$name" "$delimiter" "$value" "$delimiter" >> "$GITHUB_ENV"; fi
           done
           # The App Store Connect key is held as base64 because it is a file, not a
           # string. notarytool and electron-builder both want a path, so materialize