fix: eliminate shell injection in Telegram notify steps

[xbuddhi]

Summary

The two most recent prod deploys (#69, #70) failed before Checkout Code even ran — not a build/deploy problem, a shell-injection bug in the Telegram notify steps.

Root cause

Notify Build Start / Notify Build Complete / Notify Deploy Complete / Notify Deploy Failure interpolate ${{ github.event.head_commit.message }} (plus actor/timestamp/repository/secrets) directly into a run: bash script, inside a double-quoted curl -d text="..." argument. Any commit message containing shell metacharacters breaks or hijacks the script:

• run 35828597313: commit message contained `time` — bash expanded it as command substitution (harmlessly ran the time builtin here, but it's a live injection primitive).
• run 35828113624: commit message contained embedded double quotes ("Create wallet error: Not Found") — closed the -d text="..." string early, causing a bash syntax error (exit 2).

Both aborted the job at the very first step, so neither PR's build/deploy steps (checkout, SCP, SSH build+restart) ever ran on the server.

Fix

• Move every untrusted or secret value out of inline ${{ }} interpolation in run: and into env: — context expressions set as an env var are never re-parsed by the shell, so backticks/quotes/$() in a commit message can't be interpreted.
• Use the runner's built-in GITHUB_REPOSITORY / GITHUB_ACTOR instead of re-interpolating github.repository / github.actor.
• Switch -d to --data-urlencode so control characters in the commit message can't corrupt the form-encoded POST body sent to Telegram's API.
• Applied identically to both build-deploy.yml (prod) and build-deploy-dev.yml (dev), which share the same pattern.
• Drive-by: fixed a mojibake � → 📦 in the "Code Checked Out" message.

Verification

Reproduced both failing commit messages plus an explicit attack payload (backticks, $(), embedded quotes/semicolons) against the fixed script locally: all parse cleanly, no syntax error, no command execution.

=== lnbits ... `time` ... "cannot unmarshal ..." ===        exit 0, no injection
=== ... "Create wallet error: Not Found" ... ===             exit 0, no injection
=== evil `touch /tmp/PWNED` $(touch /tmp/PWNED2) "; touch ... ===  exit 0, no injection

Test plan

• yaml.safe_load both edited workflow files — valid YAML
• Simulated the exact run: scripts locally against the two commit messages that broke prod, and an adversarial payload — no syntax error, no injected command execution
• Merge and confirm the next real push to main/dev sends the Telegram notification correctly and deploys as expected

🤖 Generated with Claude Code

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: d8486a15-cb5a-428c-9933-c4fb589d4acb

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}