From 04bb814a527dbea2ca24e862be71995cb00508ff Mon Sep 17 00:00:00 2001
From: Jatin K Malik <jatinkrmalik@gmail.com>
Date: Thu, 12 Feb 2026 08:44:27 -0800
Subject: [PATCH] fix(ci): safely handle multi-line commit messages in deploy
 check (#194)

The previous implementation directly interpolated the commit message
into the shell script, which broke when messages contained newlines.
Words like "not" were being interpreted as shell commands.

Fix: Pass commit message via environment variable and write to temp file
before grepping, avoiding shell injection issues.
---
 .github/workflows/unified-pipeline.yml | 12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/unified-pipeline.yml b/.github/workflows/unified-pipeline.yml
index f415125..b1bb578 100644
--- a/.github/workflows/unified-pipeline.yml
+++ b/.github/workflows/unified-pipeline.yml
@@ -45,20 +45,24 @@ jobs:
               - '.github/workflows/**'
       - name: Check if website should deploy
         id: deploy_check
+        env:
+          COMMIT_MESSAGE: ${{ github.event.head_commit.message }}
         run: |
           # Deploy if web files changed OR python files changed (for version updates)
-          COMMIT_MESSAGE="${{ github.event.head_commit.message }}"
+          # Use heredoc to safely handle multi-line commit messages
+          COMMIT_MSG_FILE=$(mktemp)
+          printenv COMMIT_MESSAGE > "$COMMIT_MSG_FILE"
 
-          # Escape the commit message properly for shell comparison
-          # Use case-insensitive matching with grep instead of glob patterns
+          # Use case-insensitive matching with grep
           if [[ "${{ steps.filter.outputs.web }}" == "true" ]] || \
              [[ "${{ steps.filter.outputs.python }}" == "true" ]] || \
              [[ "${{ github.event_name }}" == "workflow_dispatch" ]] || \
-             echo "$COMMIT_MESSAGE" | grep -iE "(feat\(website\)|docs\(website\)|chore\(website\)|fix\(website\)|refactor\(website\))"; then
+             grep -iE "(feat\(website\)|docs\(website\)|chore\(website\)|fix\(website\)|refactor\(website\))" "$COMMIT_MSG_FILE"; then
             echo "deploy=true" >> $GITHUB_OUTPUT
           else
             echo "deploy=false" >> $GITHUB_OUTPUT
           fi
+          rm -f "$COMMIT_MSG_FILE"
 
   python-lint:
     name: 🔍 Lint Python