chore(ci): repoint push-email-notify to smtp-notify-action #68
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -4,19 +4,27 @@ | |
| # PUSH_EMAIL_ENABLED=true (the single on/off switch). Addresses are pre-filled; | ||
| # sending needs the org SMTP secrets (SMTP_HOST/PORT/USER/PASS). Inherited by | ||
| # new repos from the template; placed on existing repos by the farm sweep. | ||
| # | ||
| # Re-landed after the 2026-07-20 notification-storm freeze (removed in | ||
| # 09f94c5), now on hyperpolymath/smtp-notify-action: Node-free, the SMTP | ||
| # session is Idris2-specified and machine-checked, the binary is Zig-built, | ||
| # byte-reproducible, and SHA-256-pinned inside the action itself. | ||
| name: Push email notification | ||
| on: | ||
| push: | ||
| # Branch pushes only: tag and deletion payloads mislabel Branch:/head_commit. | ||
| branches: ['**'] | ||
| permissions: | ||
| contents: read | ||
| jobs: | ||
| notify: | ||
| name: Email on push | ||
| if: ${{ vars.PUSH_EMAIL_ENABLED == 'true' }} | ||
| runs-on: ubuntu-latest | ||
| timeout-minutes: 5 | ||
| steps: | ||
| - name: Send push notification email | ||
| uses: hyperpolymath/smtp-notify-action@v0.1.0 # NOSONAR — pin authority is actions.lock (sha1-1b3b752d39a4fe4c0f28f10905e4608789d3e050) | ||
|
There was a problem hiding this comment. 🩺 Stability & Availability | 🟡 Minor | ⚡ Quick win 🔎 Supported by static analysis🏁 Script executed: #!/bin/bash
set -e
printf '%s\n' '--- workflow ---'
cat -n .github/workflows/push-email-notify.yml
printf '%s\n' '--- lock file ---'
cat -n .github/workflows/actions.lock 2>/dev/null || true
printf '%s\n' '--- lock enforcement references ---'
rg -n --hidden -g '!node_modules' -g '!dist' -g '!build' 'actions\.lock|smtp-notify-action|SMTP_PORT|secure:' .Repository: hyperpolymath/alloyiser Length of output: 8830 🌐 Web query:
💡 Result: The hyperpolymath/smtp-notify-action repository does not appear to be a widely documented or standard GitHub Action; existing repositories under the hyperpolymath organization typically utilize the popular dawidd6/action-send-mail action for SMTP notifications [1][2]. When configuring SMTP actions, including those that may wrap standard libraries, the following distinctions regarding secure ports and TLS protocols apply: Port and TLS Configuration: - Implicit TLS (SMTPS): Typically associated with port 465 [3][4]. In this mode, the client and server establish an encrypted TLS connection immediately upon connection, before any SMTP commands are exchanged [3][4]. In many action configurations, this is enabled by setting a parameter like secure: true [5][6][4]. - STARTTLS: Typically associated with ports 587 or 25 [3][4]. This process begins with an unencrypted connection; the client issues an EHLO command to check for STARTTLS support, and if available, the connection is upgraded to TLS before authentication and message submission [3][4]. This is generally the default behavior when secure is set to false (or omitted) [5][6]. Recommendation: If you are using a standard SMTP-based GitHub Action, check your provider's specific requirements [4]. For most modern applications, port 587 with STARTTLS is the standard for submission [4]. Use port 465 with implicit TLS only if your provider explicitly requires or recommends it [4]. Do not attempt to initiate STARTTLS on a port configured for implicit TLS, as this will lead to connection errors [4]. Citations:
🏁 Script executed: #!/bin/bash
set -e
base='https://api.github.com/repos/hyperpolymath/smtp-notify-action'
printf '%s\n' '--- tag metadata ---'
curl -fsSL "$base/git/ref/tags/v0.1.0" | jq '{ref: .ref, object: .object}'
printf '%s\n' '--- repository tree ---'
curl -fsSL "$base/git/trees/v0.1.0?recursive=1" | jq -r '.tree[] | select(.path == "action.yml" or .path == "action.yaml" or (.path | test("(?i)(smtp|mail|readme)"))) | .path'
printf '%s\n' '--- action metadata ---'
curl -fsSL 'https://raw.githubusercontent.com/hyperpolymath/smtp-notify-action/v0.1.0/action.yml' || true
printf '%s\n' '--- README references ---'
curl -fsSL 'https://raw.githubusercontent.com/hyperpolymath/smtp-notify-action/v0.1.0/README.md' | rg -n -i -C 3 'secure|starttls|port|server_port|implicit|tls' || trueRepository: hyperpolymath/alloyiser Length of output: 4396 Use the SMTP server’s implicit-TLS port If 🧰 Tools🪛 zizmor (1.29.0)[error] 27-27: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy) (unpinned-uses) 🤖 Prompt for AI AgentsSource: MCP tools |
||
| with: | ||
| server_address: ${{ secrets.SMTP_HOST }} | ||
| server_port: ${{ secrets.SMTP_PORT }} | ||
|
|
||
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win
🔎 Supported by static analysis
🏁 Script executed:
Repository: hyperpolymath/alloyiser
Length of output: 8750
🌐 Web query:
GitHub Actions workflow syntax push branches filter branch deletion github.event.deleted push payload official documentation💡 Result:
The GitHub Actions push event does trigger when a branch is deleted [1][2]. When a branch deletion occurs, the event payload includes a
deletedboolean set totrue, and thereffield indicates the full Git reference (e.g.,refs/heads/branch-name) that was deleted [1]. Regarding workflow filtering: 1. Branch Filters: You can useon.push.branchesoron.push.branches-ignoreto restrict workflows to specific branches [3][4]. However, because branch deletion is technically a push event, these filters are evaluated against the ref being deleted [1][2]. If the deleted branch name matches yourbranchesfilter (or does not matchbranches-ignore), the workflow will be triggered [3]. 2. Handling Deletions: If you need to distinguish between a standard push and a branch deletion, you can use a conditionalifexpression in your job or step [2]. For example, you can checkif: ${{ !github.event.deleted }}to run only on standard pushes, or specifically handle deletions by checkingif: ${{ github.event.deleted }}[2]. 3. Alternative Triggers: For more granular control over branch deletions, consider using thedeleteevent instead [1][5]. Thedeleteevent is specifically designed to trigger when a branch or tag is removed and provides a payload containing theref_type(e.g.,branch) and therefname [6][1]. When a branch is deleted, theGITHUB_SHAin the workflow run context defaults to the tip commit of the repository's default branch, rather than the SHA of the deleted branch at the time of deletion [7][5].Citations:
Exclude deleted branches explicitly.
branches: ['**']also matches deleted branch refs. A deletion payload can reach the email step with empty or invalidhead_commitdata. Addgithub.event.deleted != trueto the job condition.🧰 Tools
🪛 zizmor (1.29.0)
[warning] 13-16: insufficient job-level concurrency limits (concurrency-limits): workflow is missing concurrency setting
(concurrency-limits)
🤖 Prompt for AI Agents
Source: MCP tools