diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index 553fb48d..afaf9579 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -50,10 +50,13 @@ jobs:
     - name: Validate commit (only for push events)
       if: github.event_name == 'push'
       id: commit-check
+      # 注意：commit message 是用户可控的多行文本，必须经 env 传入。
+      # 直接写 ${{ github.event.head_commit.message }} 会把内容展开进脚本，
+      # 多行信息或含 $ / ` 的字符会导致 "bad substitution" 甚至命令注入。
+      env:
+        COMMIT_AUTHOR: ${{ github.event.head_commit.author.name }}
+        COMMIT_MESSAGE: ${{ github.event.head_commit.message }}
       run: |
-        COMMIT_AUTHOR="${{ github.event.head_commit.author.name }}"
-        COMMIT_MESSAGE="${{ github.event.head_commit.message }}"
-        
         echo "📝 提交作者: $COMMIT_AUTHOR"
         echo "📄 提交信息: $COMMIT_MESSAGE"