TelegramAutoSignBot

简体中文

Send scheduled commands from a Telegram user account to a small, configured list of bots using Telethon and GitHub Actions.

This uses a user session, not the Telegram Bot API. A session string grants account access: keep it private and use only automation permitted by Telegram and the target bots.

Quick start

1. Create a private deployment copy and review the workflow.
2. Obtain your Telegram application credentials and create a Telethon StringSession on a trusted machine.
3. Add the settings below to Settings → Secrets and variables → Actions.
4. Run Telegram Auto Sign and verify the conversations in Telegram.

Setting	Store as	Purpose
API_ID	Secret	Telegram application ID
API_HASH	Secret	Telegram application hash
SESSION_STRING	Secret	User account StringSession
BOT_CONFIG	Variable	Comma-separated bot_username:command entries

Example target configuration:

@example_bot:/qd,@another_bot:sign

An entry without a command uses /qd. Other commands are sent as configured; no slash is added automatically. Never print a session string to public logs or generate it through an untrusted website.

Schedule and failures

The workflow runs daily at 00:00 UTC, with a random initial delay of 1–5 minutes and 2–5 seconds between targets. Runs are serialized and capped at 20 minutes. Delays do not guarantee that automation is permitted.

Target-specific errors allow later targets to run. Account errors, rate limits and uncertain transport outcomes stop the batch without automatic resending. Any failure produces a nonzero exit.

checkin.log on the logs branch records timestamps and counts, including partial runs. submitted means the send call returned; it does not prove the destination bot accepted a check-in. Updating this branch needs contents: write permission.

Development

Use the Python version and Telethon dependency declared in the offline test workflow, then run:

python -m unittest discover -s tests

The tests mock Telegram access. Running main.py with real settings sends messages. If a send outcome is uncertain, check Telegram before rerunning. Revoke the session if its credential is exposed.

Support and contributing

Support · Contributing · Security · Code of conduct

License

MIT.

Weekly secret scan

Weekly all-branch secret scan scans all branches and history on Mondays at 04:23 UTC (12:23 Asia/Shanghai). GitHub schedules can be delayed or skipped; an active workflow alone does not prove a scan ran. Check the Actions run history and use workflow_dispatch when a scheduled run is missing.

A successful Secret scan / Gitleaks job verifies the scanner completed. It does not run the application's account workflow. Findings retain paths and rule names only; never copy secret values into logs, issues or documentation.