chore(ci): repoint push-email-notify to smtp-notify-action #505
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,25 +1,46 @@ | ||
| # SPDX-License-Identifier: MPL-2.0 | ||
| # This workflow is managed by gh actions-lock. | ||
| # Dormant push-email notification. ARMED by setting the repo variable | ||
| # PUSH_EMAIL_ENABLED=true (the single on/off switch). Addresses are pre-filled; | ||
| # sending needs the org SMTP secrets (SMTP_HOST/PORT/USER/PASS). Inherited by | ||
| # new repos from the template; placed on existing repos by the farm sweep. | ||
| # | ||
| # Re-landed after the 2026-07-20 notification-storm freeze (removed in | ||
| # 09f94c5), now on hyperpolymath/smtp-notify-action: Node-free, the SMTP | ||
| # session is Idris2-specified and machine-checked, the binary is Zig-built, | ||
| # byte-reproducible, and SHA-256-pinned inside the action itself. | ||
| name: Push email notification | ||
| on: | ||
| push: | ||
| # Branch pushes only: tag and deletion payloads mislabel Branch:/head_commit. | ||
| branches: ['**'] | ||
| concurrency: | ||
| # Deliberately per-RUN, so no run is ever queued behind another and none is | ||
| # ever cancelled. Do NOT "tidy" this into a shared group such as | ||
| # ${{ github.workflow }}-${{ github.ref }}. GitHub's workflow-syntax docs: | ||
| # "By default, any existing pending job or workflow in the same concurrency | ||
| # group will be canceled and the new queued job or workflow will take its | ||
| # place." That happens regardless of cancel-in-progress, which governs only | ||
| # the RUNNING job. On this workflow it silently loses a notification email, | ||
| # with no error anywhere. Every run here reports a DISTINCT commit, so there | ||
| # is no redundant work for a concurrency limit to remove. | ||
| # The docs also offer `queue: max` (up to 100 pending); not used, because 100 | ||
| # is still a cap whereas a per-run group needs none. | ||
| # Verified with zizmor 1.30.0: deleting this block raises concurrency-limits; | ||
| # this form silences it exactly as a shared group would. | ||
| group: push-email-${{ github.run_id }} | ||
| cancel-in-progress: false | ||
| permissions: | ||
| contents: read | ||
| jobs: | ||
| notify: | ||
| name: Email on push | ||
| if: ${{ vars.PUSH_EMAIL_ENABLED == 'true' }} | ||
| runs-on: ubuntu-latest | ||
| timeout-minutes: 5 | ||
| steps: | ||
| - name: Send push notification email | ||
| uses: hyperpolymath/smtp-notify-action@v0.2.0 # NOSONAR — pin authority is actions.lock (sha1-ede1191ef6ff3ac02c4f4d9efdf837ee517e11d7) | ||
|
Contributor
There was a problem hiding this comment. 🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win 🔎 Supported by static analysis🏁 Script executed: #!/bin/bash
set -eu
printf '%s\n' '--- workflow excerpt ---'
sed -n '1,90p' .github/workflows/push-email-notify.yml
printf '%s\n' '--- action references and SMTP inputs ---'
rg -n -C 3 'smtp-notify-action|SMTP_PORT|secure|STARTTLS|implicit TLS|465|587' .github README.md docs 2>/dev/null || trueRepository: hyperpolymath/gitbot-fleet Length of output: 9822 🤖 get_repo_knowledge executed:
Length of output: 410 🌐 Web query:
💡 Result: There is no publicly available GitHub Action specifically named hyperpolymath/smtp-notify-action. Analysis of the hyperpolymath organization's repositories reveals that they consistently use the widely adopted dawidd6/action-send-mail action for their email notification workflows [1][2][3][4][5][6][7]. For the dawidd6/action-send-mail action (and similar tools like simonsfoundation/action-send-mail [8]), the handling of secure SMTP ports and STARTTLS is generally managed through the following configuration parameters: - server_port: Specifies the SMTP server port (e.g., 465 for implicit TLS or 587 for STARTTLS) [9][8]. - secure: A boolean flag. When set to true, it typically enables implicit TLS (common with port 465) [8]. When set to false, it is often used for connections that upgrade to TLS via the STARTTLS command (common with port 587) [8]. If you are configuring your own workflows, you should check the documentation for the specific action you are using (e.g., dawidd6/action-send-mail), as parameter behaviors can vary between different action implementations [10][8]. To achieve a secure connection using STARTTLS, you would typically set your server_port to 587 and ensure the secure flag is set to false (unless the action's documentation specifies otherwise for STARTTLS) [8]. Citations:
🏁 Script executed: #!/bin/bash
set -u
base='https://api.github.com/repos/hyperpolymath/smtp-notify-action'
printf '%s\n' '--- repository metadata ---'
curl -sS -D /tmp/smtp-headers "$base" -o /tmp/smtp-repo.json
sed -n '1p' /tmp/smtp-headers
python3 - <<'PY'
import json
try:
d=json.load(open('/tmp/smtp-repo.json'))
print({k:d.get(k) for k in ('message','html_url','default_branch','archived')})
except Exception as e:
print(e)
PY
printf '%s\n' '--- v0.2.0 ref ---'
curl -sS -D /tmp/smtp-ref-headers "$base/git/ref/tags/v0.2.0" -o /tmp/smtp-ref.json
sed -n '1p' /tmp/smtp-ref-headers
python3 - <<'PY'
import json
try:
d=json.load(open('/tmp/smtp-ref.json'))
print(d)
except Exception as e:
print(e)
PY
printf '%s\n' '--- action.yml at tag ---'
curl -sS -D /tmp/smtp-action-headers 'https://raw.githubusercontent.com/hyperpolymath/smtp-notify-action/v0.2.0/action.yml' -o /tmp/smtp-action.yml
sed -n '1p' /tmp/smtp-action-headers
sed -n '1,220p' /tmp/smtp-action.ymlRepository: hyperpolymath/gitbot-fleet Length of output: 6283 🌐 Web query:
💡 Result: The repository’s secure: trueHere, Citations: Configure
🤖 Prompt for AI Agents |
||
| with: | ||
| server_address: ${{ secrets.SMTP_HOST }} | ||
| server_port: ${{ secrets.SMTP_PORT }} | ||
|
|
||
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
🎯 Functional Correctness | 🟠 Major | ⚡ Quick win
🔎 Supported by static analysis
🏁 Script executed:
Repository: hyperpolymath/gitbot-fleet
Length of output: 4489
🤖 get_repo_knowledge executed:
get_repo_knowledge hyperpolymath/gitbot-fleet /tmp/coderabbit-repo-knowledge/hyperpolymath-gitbot-fleet-a78cd8e9Length of output: 397
🌐 Web query:
GitHub Actions push event branch deletion github.event.deleted branches filter documentation💡 Result:
GitHub Actions does not provide a built-in filter to exclude or include branch deletions within the push event configuration [1][2][3]. When a branch is deleted, GitHub triggers a push event to the repository's default branch, which can inadvertently trigger workflows configured to run on pushes to that default branch [1][4][5]. To handle this, you can use conditional job execution (the
ifkeyword) to detect and filter out deletions within your workflow [4][6]. Detecting Deletions The push event payload includes a boolean field nameddeleted[5][7]. You can access this in your workflow using the github context: if: ${{!github.event.deleted }} This condition ensures the job only runs for standard pushes and not when a branch is deleted [4]. Handling Deletions Specifically If you instead wish to trigger a workflow only when a branch is deleted, you should use the delete event rather than the push event [6][5]. Note that for delete events, the GITHUB_REF variable points to the default branch, so you must use the event payload to identify which branch was deleted [1][6][8]. Example of filtering out deletions: jobs: build: if: ${{!github.event.deleted }} runs-on: ubuntu-latest steps: - run: echo "This job runs only on standard pushes." Example of acting on a specific branch deletion: on: delete: jobs: cleanup: if: ${{ github.event.ref_type == 'branch' && github.event.ref == 'my-target-branch' }} runs-on: ubuntu-latest steps: - run: echo "Cleaning up resources for deleted branch: ${{ github.event.ref }}" Summary of Key Differences: - Push event: Triggers for commits, creation, and deletion [4][5]. Filter by checking!github.event.deleted [4]. - Delete event: Specifically for deletions of branches or tags [5]. Access the branch name via github.event.ref [6][8].Citations:
Exclude branch-deletion push events explicitly.
When
PUSH_EMAIL_ENABLEDistrue, thenotifyjob can run for a branch-deletionpushpayload and send an email without a commit message. Add!github.event.deletedto the job condition.🤖 Prompt for AI Agents