telegram-notify.yml

# .github/workflows/telegram-notifier.yml
name: Telegram Notifier

on:
  push:
    branches: ["**"]
    tags: ["*"]
  pull_request:
    types: [opened, reopened, synchronize, closed]
  release:
    types: [published]
  workflow_dispatch:
    inputs:
      text:
        description: "Message to send"
        required: true
      title:
        description: "Optional manual title (default: 📣 Manual)"
        required: false
        default: "📣 Manual"
      chat_id:
        description: "Override TG_CHAT_ID (e.g. @Channel or numeric id)"
        required: false

permissions:
  contents: read

concurrency:
  group: telegram-${{ github.ref }}-${{ github.event_name }}
  cancel-in-progress: false

jobs:
  notify:
    runs-on: ubuntu-latest
    environment: SANDBOX   # must contain secrets TG_BOT_TOKEN and TG_CHAT_ID

    steps:
      - name: Checkout (for commit log)
        uses: actions/checkout@v4
        with:
          fetch-depth: 50

      - name: Build message (MarkdownV2)
        id: msg
        shell: bash
        env:
          REPO: ${{ github.repository }}
          ACTOR: ${{ github.actor }}
          EVENT: ${{ github.event_name }}
          REF_NAME: ${{ github.ref_name }}
          RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
          REPO_URL: ${{ github.server_url }}/${{ github.repository }}

          GIT_BEFORE: ${{ github.event.before }}
          GIT_SHA: ${{ github.sha }}

          PR_NUMBER: ${{ github.event.pull_request.number }}
          PR_TITLE: ${{ github.event.pull_request.title }}
          PR_URL: ${{ github.event.pull_request.html_url }}
          PR_ACTION: ${{ github.event.action }}
          PR_MERGED: ${{ github.event.pull_request.merged }}

          REL_TAG: ${{ github.event.release.tag_name }}
          REL_NAME: ${{ github.event.release.name }}
          REL_URL: ${{ github.event.release.html_url }}

          WD_TEXT:  ${{ github.event.inputs.text }}
          WD_TITLE: ${{ github.event.inputs.title }}
        run: |
          set -euo pipefail

          # Telegram MarkdownV2 escaper
          mde() {
            sed -e 's/\\/\\\\/g' \
                -e 's/_/\\_/g'  -e 's/*/\\*/g'  -e 's/\[/\\[/g'  -e 's/]/\\]/g' \
                -e 's/(/\\(/g'  -e 's/)/\\)/g'  -e 's/~/\\~/g'  -e 's/`/\\`/g' \
                -e 's/>/\\>/g'  -e 's/#/\\#/g'  -e 's/\\+/\\\\+/g' \
                -e 's/-/\\-/g'  -e 's/=/\\=/g'  -e 's/|/\\|/g'  -e 's/{/\\{/g' -e 's/}/\\}/g' \
                -e 's/\./\\./g' -e 's/!/\\!/g'
          }

          header() {
            printf '%s\nRepo: %s\nBy: %s\nRef: %s\nRun: %s\n' \
              "$(printf '%s' "$1")" \
              "$(printf '%s' "$REPO"     | mde)" \
              "$(printf '%s' "$ACTOR"    | mde)" \
              "$(printf '%s' "$REF_NAME" | mde)" \
              "$(printf '%s' "$RUN_URL"  | mde)"
          }

          MESSAGE=""

          if [[ "$EVENT" == "workflow_dispatch" ]]; then
            TITLE="${WD_TITLE:-📣 Manual}"
            # Minimal manual card: Title + By + Run + your text
            MESSAGE="$(header "$(printf '%s' "$TITLE" | mde)")"
            MSG_ESC="$(printf '%s' "${WD_TEXT:-}" | mde)"
            MESSAGE="${MESSAGE}\n${MSG_ESC}"

          elif [[ "$EVENT" == "push" ]]; then
            BEFORE="${GIT_BEFORE:-}"
            AFTER="$GIT_SHA"

            if [[ -z "$BEFORE" || "$BEFORE" =~ ^0+$ ]]; then
              mapfile -t LINES < <(git log -n 10 --pretty=format:'%s%x1f%h%x1f%an' "$AFTER" || true)
            else
              mapfile -t LINES < <(git log --pretty=format:'%s%x1f%h%x1f%an' "$BEFORE..$AFTER" | head -n 10 || true)
            fi

            COMMITS_TXT=""
            if [[ ${#LINES[@]} -eq 0 ]]; then
              COMMITS_TXT="- (no commit messages found)"
            else
              for row in "${LINES[@]}"; do
                IFS=$'\x1f' read -r subj short author <<<"$row"
                COMMITS_TXT+="- $(printf '%s' "$subj"   | mde) ($(printf '%s' "$short" | mde)) by $(printf '%s' "$author" | mde)\n"
              done
            fi

            MESSAGE="$(header '📣 Last 10 commits')\n${COMMITS_TXT}\nRepo: $(printf '%s' "$REPO_URL" | mde)"

          elif [[ "$EVENT" == "pull_request" ]]; then
            if [[ "$PR_ACTION" == "closed" ]]; then
              [[ "${PR_MERGED}" == "true" ]] && STATUS="PR merged ✅" || STATUS="PR closed ❌"
            else
              STATUS="PR updated ✏️"
            fi
            MESSAGE="$(header "$(printf '%s' "$STATUS" | mde)")\n#${PR_NUMBER}: $(printf '%s' "$PR_TITLE" | mde)\n$(printf '%s' "$PR_URL" | mde)"

          elif [[ "$EVENT" == "release" ]]; then
            NAME="${REL_NAME:-$REL_TAG}"
            MESSAGE="$(header 'Release published 🏷️')\nTag: $(printf '%s' "$REL_TAG" | mde)\nName: $(printf '%s' "$NAME" | mde)\n$(printf '%s' "$REL_URL" | mde)"

          else
            MESSAGE="$(header "Event: $(printf '%s' "$EVENT" | mde)")"
          fi

          # Safe multi-line output (no stray EOF problems)
          {
            printf 'text<<MSGEOF\n'
            printf '%s\n' "$MESSAGE"
            printf 'MSGEOF\n'
          } >> "$GITHUB_OUTPUT"

      - name: Send to Telegram
        shell: bash
        env:
          TG_BOT_TOKEN: ${{ secrets.TG_BOT_TOKEN }}
          TG_CHAT_ID_DEFAULT: ${{ secrets.TG_CHAT_ID }}
          TEXT: ${{ steps.msg.outputs.text }}
          OVERRIDE_CHAT_ID: ${{ github.event.inputs.chat_id }}
        run: |
          set -euo pipefail
          CHAT_ID="${OVERRIDE_CHAT_ID:-$TG_CHAT_ID_DEFAULT}"
          [[ -n "${TG_BOT_TOKEN:-}" && -n "${CHAT_ID:-}" ]] || { echo "Missing TG secrets"; exit 1; }

          curl -sS -X POST "https://api.telegram.org/bot${TG_BOT_TOKEN}/sendMessage" \
            -H 'Content-Type: application/json' \
            -d "$(jq -n \
                  --arg chat_id "$CHAT_ID" \
                  --arg text "$TEXT" \
                  '{chat_id:$chat_id, text:$text, parse_mode:"MarkdownV2", disable_web_page_preview:true}')" \
          | jq -e '.ok == true' >/dev/null

          echo "✅ Message sent to Telegram."