fix(autodoc): trailing newline + random delimiter in eval context output

[jdcmsd]

What broke and why

The first real trigger of the prep → claude → finalize pipeline (#36495) failed in Build evaluation context with:

##[error]Invalid value. Matching delimiter not found '__AUTODOC_EOF__'

Root cause: the Python script wrote /tmp/eval_context.md via '\n'.join(lines) with no trailing newline. The file's last character was . (end of "Use the Write tool to write the report to exactly that path."). When cat piped that into GITHUB_OUTPUT, echo '__AUTODOC_EOF__' appended directly to the last line of content rather than starting a new one. The runner looked for __AUTODOC_EOF__ as a standalone line and never found it.

This code path was introduced in the OIDC restructure and had never successfully run against a real issue before this trigger.

Fixes

1. Trailing newline: '\n'.join(lines) + '\n' — ensures the delimiter always lands on its own line.
2. Random delimiter: openssl rand -hex 16 — defense-in-depth so no future issue or PR body can accidentally inject the closing token. This is the GitHub-recommended pattern for multiline outputs.

Fixes #36949

🤖 Generated with Claude Code

[claude]

Claude finished @jdcmsd's task in 32s —— View job

---

Code Review

• Gather context (read diff + surrounding workflow code)
• Analyze the fix
• Post review

Reviewed .github/workflows/issue_autodoc.yml (git diff origin/main...HEAD).

Both changes are correct and directly address the root cause described in #36949.

1. Trailing newline (issue_autodoc.yml:307) — '\n'.join(lines) + '\n' guarantees the file ends on a newline, so echo "${DELIM}" lands on its own line rather than being appended to the last content line. This is exactly the failure the runner hit (Matching delimiter not found). ✅

2. Random delimiter (issue_autodoc.yml:311-315) — openssl rand -hex 16 produces a 32-char hex token that cannot realistically appear in issue/PR body content, eliminating the delimiter-injection class of bug entirely. This matches GitHub's documented pattern for multiline outputs. ✅

Minor notes (non-blocking):

• openssl is present on GitHub-hosted ubuntu runners by default, so the new dependency is safe. If this job could ever run on a minimal self-hosted runner, that assumption would need re-checking — but nothing in the diff suggests that.
• With the two fixes combined, even if content ever contained the delimiter, the << heredoc would still be well-formed because the token is randomized per run.

New Issues

No issues found.

The fix is minimal, correct, and follows the recommended GitHub Actions convention. LGTM.
· fix/autodoc-eval-context-newline