chore(ci): repoint push-email-notify to smtp-notify-action #309
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,23 +1,30 @@ | ||
| # SPDX-License-Identifier: MPL-2.0 | ||
| # This workflow is managed by gh actions-lock. | ||
| # Dormant push-email notification. ARMED by setting the repo variable | ||
| # PUSH_EMAIL_ENABLED=true (the single on/off switch). Addresses are pre-filled; | ||
| # sending needs the org SMTP secrets (SMTP_HOST/PORT/USER/PASS). Inherited by | ||
| # new repos from the template; placed on existing repos by the farm sweep. | ||
| # | ||
| # Re-landed after the 2026-07-20 notification-storm freeze (removed in | ||
| # 09f94c5), now on hyperpolymath/smtp-notify-action: Node-free, the SMTP | ||
| # session is Idris2-specified and machine-checked, the binary is Zig-built, | ||
| # byte-reproducible, and SHA-256-pinned inside the action itself. | ||
| name: Push email notification | ||
| on: | ||
| push: | ||
| # Branch pushes only: tag and deletion payloads mislabel Branch:/head_commit. | ||
| branches: ['**'] | ||
| permissions: | ||
| contents: read | ||
| jobs: | ||
| notify: | ||
| name: Email on push | ||
| if: ${{ vars.PUSH_EMAIL_ENABLED == 'true' }} | ||
| runs-on: ubuntu-latest | ||
| timeout-minutes: 5 | ||
| steps: | ||
| - name: Send push notification email | ||
| uses: hyperpolymath/smtp-notify-action@v0.1.0 # NOSONAR — pin authority is actions.lock (sha1-1b3b752d39a4fe4c0f28f10905e4608789d3e050) | ||
|
There was a problem hiding this comment. 🔒 Security & Privacy | 🟠 Major | ⚡ Quick win 🔎 Supported by static analysis🏁 Script executed: #!/usr/bin/env bash
set -euo pipefail
expected="1b3b752d39a4fe4c0f28f10905e4608789d3e050"
actual="$(sed -nE 's/^[[:space:]]*uses: hyperpolymath\/smtp-notify-action@([^[:space:]#]+).*/\1/p' .github/workflows/push-email-notify.yml)"
test "$actual" = "$expected"Repository: hyperpolymath/echo-types Length of output: 162 🏁 Script executed: #!/usr/bin/env bash
set -euo pipefail
printf '%s\n' '--- workflow reference ---'
sed -n '20,32p' .github/workflows/push-email-notify.yml
printf '%s\n' '--- lock entry ---'
sed -n '72,86p' .github/workflows/actions.lock
printf '%s\n' '--- exact parsed reference ---'
sed -nE 's/^[[:space:]]*uses: hyperpolymath\/smtp-notify-action@([^[:space:]#]+).*/\1/p' .github/workflows/push-email-notify.ymlRepository: hyperpolymath/echo-types Length of output: 1145 🌐 Web query:
💡 Result: There is no public GitHub repository named hyperpolymath/smtp-notify-action. The user hyperpolymath frequently uses the third-party GitHub Action dawidd6/action-send-mail to implement push-email notifications within their repositories [1][2]. It appears the user may be conflating this specific workflow implementation with a standalone action [1][3][4]. The push-email notification functionality in repositories owned by hyperpolymath is typically managed via a reusable workflow file (e.g.,.github/workflows/push-email-notify.yml) which utilizes dawidd6/action-send-mail [1][2]. No evidence of an action repository named smtp-notify-action exists under the hyperpolymath organization. Citations:
🏁 Script executed: #!/usr/bin/env bash
set -euo pipefail
repo='hyperpolymath/smtp-notify-action'
tag='v0.1.0'
candidate='1b3b752d39a4fe4c0f28f10905e4608789d3e050'
printf '%s\n' '--- tag ref ---'
curl -fsSL -H 'Accept: application/vnd.github+json' \
"https://api.github.com/repos/${repo}/git/ref/tags/${tag}" |
jq '{ref, type: .object.type, sha: .object.sha}'
printf '%s\n' '--- candidate commit ---'
curl -fsSL -H 'Accept: application/vnd.github+json' \
"https://api.github.com/repos/${repo}/commits/${candidate}" |
jq '{sha, message: .commit.message}'Repository: hyperpolymath/echo-types Length of output: 1258 🏁 Script executed: #!/usr/bin/env bash
set -euo pipefail
repo='hyperpolymath/smtp-notify-action'
tag_object='1fb433a0048cf21f40499d54b1bd236ad52b6bc9'
candidate='1b3b752d39a4fe4c0f28f10905e4608789d3e050'
printf '%s\n' '--- annotated tag target ---'
curl -fsSL -H 'Accept: application/vnd.github+json' \
"https://api.github.com/repos/${repo}/git/tags/${tag_object}" |
jq '{tag, object_type: .object.type, target: .object.sha}'
printf '%s\n' '--- resolved target commit ---'
target="$(curl -fsSL -H 'Accept: application/vnd.github+json' \
"https://api.github.com/repos/${repo}/git/tags/${tag_object}" | jq -r '.object.sha')"
curl -fsSL -H 'Accept: application/vnd.github+json' \
"https://api.github.com/repos/${repo}/commits/${target}" |
jq '{sha, message: .commit.message}'
printf '%s\n' '--- comparison ---'
printf 'tag_target=%s\ncandidate=%s\n' "$target" "$candidate"
test "$target" = "$candidate"Repository: hyperpolymath/echo-types Length of output: 1402 Pin the action to the locked commit SHA. Line 27 uses mutable tag 🧰 Tools🪛 zizmor (1.29.0)[error] 27-27: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy) (unpinned-uses) 🤖 Prompt for AI AgentsSources: MCP tools, Linters/SAST tools |
||
| with: | ||
| server_address: ${{ secrets.SMTP_HOST }} | ||
| server_port: ${{ secrets.SMTP_PORT }} | ||
|
|
||
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
🩺 Stability & Availability | 🟡 Minor | ⚡ Quick win
🔎 Supported by static analysis
🏁 Script executed:
Repository: hyperpolymath/echo-types
Length of output: 19728
🌐 Web query:
GitHub Actions concurrency default workflow runs concurrent by default at most one running and one pending documentation💡 Result:
By default, when you define a concurrency group in GitHub Actions, the system ensures that at most one job or workflow run is running at any time [1][2]. If another job or workflow within the same concurrency group is already in progress, any subsequent queued job or workflow will be placed in a pending state [1][2]. Regarding the default behavior for pending runs, GitHub Actions is configured to maintain at most one pending job or workflow run in the group [1][2]. If a new job or workflow is queued while another is already pending, the existing pending job or workflow is canceled, and the new one replaces it [1][2]. This behavior is explicitly referred to in documentation as "single" (the default mode) [1][2]. If you wish to allow more runs to queue instead of being automatically canceled, you can change this behavior by setting the concurrency configuration to "max," which allows up to 100 jobs or workflow runs to wait in the queue [1][2].
Citations:
🌐 Web query:
site:docs.github.com GitHub Actions without concurrency multiple workflow runs default concurrent💡 Result:
By default, GitHub Actions allows multiple workflow runs and jobs to execute concurrently [1][2]. There is no default limit that restricts a workflow to a single concurrent run; rather, instances of the same workflow can run simultaneously across a repository [1][3]. To change this behavior and restrict concurrency, you must use the concurrency keyword within your workflow file [4][5]. When you define a concurrency group, the default behavior is that only one run can be active (running or pending) at a time [4][3]. If a new run is triggered while another is in progress, the older pending run is automatically canceled by default [4][6]. If you wish to allow multiple runs to queue sequentially instead of canceling previous ones, you can configure the concurrency group to use queuing, which allows up to 100 workflow runs or jobs to wait in line [4][7]. This is achieved by setting the concurrency configuration to use queue: max [4][3]. In summary, GitHub Actions is concurrent by default, and the concurrency keyword is the mechanism provided to opt into sequential execution or controlled queuing [1][6].
Citations:
Define the notification burst policy before enabling the gate.
When
PUSH_EMAIL_ENABLEDistrue,branches: ['**']starts thenotifyjob for each branch push. Without aconcurrencygroup, several SMTP jobs can run concurrently.timeout-minutes: 5limits job duration, not concurrency.If every push must generate an email, use bounded queueing or SMTP rate limiting. If newer pushes can replace older notifications, add a global concurrency group with
cancel-in-progress: true.🧰 Tools
🪛 zizmor (1.29.0)
[warning] 13-16: insufficient job-level concurrency limits (concurrency-limits): workflow is missing concurrency setting
(concurrency-limits)
🤖 Prompt for AI Agents
Sources: MCP tools, Linters/SAST tools