I helped @rafidaslam look at this problem briefly during the Wikimedia-Hackathon-2018. It seems that the true comes from the code:

# Ask git if colors should be used
# Raises CalledProcessError if disabled
subprocess.check_call([
    'git', 'config', '--get-colorbool',
    'color.commit_message_validator', stdout_is_tty
])

From the man page:

--get-colorbool name [stdout-is-tty]

Find the color setting for name (e.g. color.diff) and output "true" or "false". stdout-is-tty should be either "true" or "false", and is taken into account when configuration says "auto". If stdout-is-tty is missing, then checks the standard output of the command itself, and exits with status 0 if color is to be used, or exits with status 1 otherwise. When the color setting for name is undefined, the command uses color.ui as fallback.

I think I wrongly assumed that subprocess.check_call suppressed output to stdout and stderr. This actually needs to be done manually in the call. One example of doing this that I found on StackOverflow could look something like (danger! untested code follows):

dev_null = open(os.devnull, 'w')
subprocess.check_call([
    'git', 'config', '--get-colorbool',
    'color.commit_message_validator', stdout_is_tty
], stdout=dev_null, stderr=subprocess.STDOUT)

Change 438234 had a related patch set uploaded (by Rafidaslam; owner: Rafid Aslam):
[integration/commit-message-validator@master] __init__.py: Supress unintentional 'true' print in ansi_codes()

https://gerrit.wikimedia.org/r/438234

Change 438234 merged by jenkins-bot:
[integration/commit-message-validator@master] __init__.py: Supress unintentional 'true' print in ansi_codes()

https://gerrit.wikimedia.org/r/438234