chore(ci): repoint push-email-notify to smtp-notify-action #46
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change | ||||
|---|---|---|---|---|---|---|
| @@ -1,24 +1,30 @@ | ||||||
| # SPDX-License-Identifier: MPL-2.0 | ||||||
| # This workflow is managed by gh actions-lock. | ||||||
| # Dormant push-email notification. ARMED by setting the repo variable | ||||||
| # PUSH_EMAIL_ENABLED=true (the single on/off switch). Addresses are pre-filled; | ||||||
| # sending needs the org SMTP secrets (SMTP_HOST/PORT/USER/PASS). Inherited by | ||||||
| # new repos from the template; placed on existing repos by the farm sweep. | ||||||
| # | ||||||
| # Re-landed after the 2026-07-20 notification-storm freeze (removed in | ||||||
| # 09f94c5), now on hyperpolymath/smtp-notify-action: Node-free, the SMTP | ||||||
| # session is Idris2-specified and machine-checked, the binary is Zig-built, | ||||||
| # byte-reproducible, and SHA-256-pinned inside the action itself. | ||||||
| name: Push email notification | ||||||
| on: | ||||||
| push: | ||||||
| # Branch pushes only: tag and deletion payloads mislabel Branch:/head_commit. | ||||||
| branches: ['**'] | ||||||
| permissions: | ||||||
| contents: read | ||||||
|
There was a problem hiding this comment. 🔒 Security & Privacy | 🟠 Major | ⚡ Quick win 🔎 Supported by static analysis🏁 Script executed: #!/bin/bash
set -eu
printf '%s\n' '--- repository conventions ---'
find /tmp/coderabbit-repo-knowledge/hyperpolymath-contractiles-504e77ea -maxdepth 2 -type f -name '*.md' -print
printf '%s\n' '--- workflow ---'
cat -n .github/workflows/push-email-notify.yml
printf '%s\n' '--- action lock entry ---'
sed -n '105,120p' .github/workflows/actions.lock
printf '%s\n' '--- repository permission usage in workflows ---'
rg -n -C 2 'permissions:|contents:|smtp-notify-action|github\.token' .github/workflowsRepository: hyperpolymath/contractiles Length of output: 22554 🏁 Script executed: #!/bin/bash
set -eu
printf '%s\n' '--- applicable repository convention ---'
cat /tmp/coderabbit-repo-knowledge/hyperpolymath-contractiles-504e77ea/conventions/repo-wide.md
printf '%s\n' '--- workflow permission contract ---'
sed -n '48,64p' .github/workflows/workflow-linter.ymlRepository: hyperpolymath/contractiles Length of output: 1120 🌐 Web query:
💡 Result: In GitHub Actions, the permissions key is used to modify the access rights of the GITHUB_TOKEN for a workflow or specific jobs [1][2]. Setting permissions: contents: read allows the GITHUB_TOKEN to perform read-only operations on the repository's contents, such as listing commits, while restricting other actions that require write access (like creating a release) [1][3]. When you define the permissions key, any permissions not explicitly specified are automatically set to none [1][2]. The write access level implicitly includes read access [1][4]. You can apply the permissions key at two levels: 1. Top-level: Applied to all jobs in the workflow [2]. 2. Job-level: Applied to specific jobs, overriding any top-level configuration [2]. Example configuration for a job: permissions: contents: read For security, it is best practice to follow the principle of least privilege by granting only the minimum access required for your automation [5][6]. You can also use read-all or write-all to set all permissions at once, though specific granular control is recommended for better security [2]. Citations:
🌐 Web query:
💡 Result: There is no public GitHub repository under the name "hyperpolymath/smtp-notify-action" [1][2]. It appears you may be confusing this with the "dawidd6/action-send-mail" GitHub Action, which is frequently used by the "hyperpolymath" organization in their workflows [1][2]. In the workflows used by hyperpolymath, the "dawidd6/action-send-mail" action does not require specific GitHub token permissions beyond the default read access to contents, as it primarily relies on SMTP credentials stored in GitHub Secrets (e.g., SMTP_HOST, SMTP_PORT, SMTP_USER, SMTP_PASS) to perform its function [1][2][3]. If you were creating a custom action file ( Citations:
🏁 Script executed: #!/bin/bash
set -eu
for url in \
'https://api.github.com/repos/hyperpolymath/smtp-notify-action' \
'https://api.github.com/repos/hyperpolymath/smtp-notify-action/contents/action.yml?ref=v0.1.0' \
'https://api.github.com/repos/hyperpolymath/smtp-notify-action/commits/1b3b752d39a4fe4c0f28f10905e4608789d3e050'
do
printf '\n--- %s ---\n' "$url"
curl -L --silent --show-error -w '\nHTTP %{http_code}\n' "$url" | sed -n '1,35p'
doneRepository: hyperpolymath/contractiles Length of output: 12325 Set workflow permissions to
🤖 Prompt for AI Agents |
||||||
| jobs: | ||||||
| notify: | ||||||
| name: Email on push | ||||||
| if: ${{ vars.PUSH_EMAIL_ENABLED == 'true' }} | ||||||
| runs-on: ubuntu-latest | ||||||
| timeout-minutes: 5 | ||||||
| steps: | ||||||
| - name: Send push notification email | ||||||
| uses: hyperpolymath/smtp-notify-action@v0.1.0 # NOSONAR — pin authority is actions.lock (sha1-1b3b752d39a4fe4c0f28f10905e4608789d3e050) | ||||||
|
There was a problem hiding this comment. 🩺 Stability & Availability | 🟡 Minor | ⚡ Quick win 🔎 Supported by static analysis🏁 Script executed: #!/bin/bash
set -eu
printf '%s\n' '--- workflow ---'
cat -n .github/workflows/push-email-notify.yml
printf '%s\n' '--- action lock entry ---'
sed -n '105,120p' .github/workflows/actions.lock
printf '%s\n' '--- scoped repository conventions ---'
find /tmp/coderabbit-repo-knowledge/hyperpolymath-contractiles-504e77ea -maxdepth 2 -type f -name '*.md' -printRepository: hyperpolymath/contractiles Length of output: 4125 🏁 Script executed: #!/bin/bash
set -eu
printf '%s\n' '--- repository-wide workflow conventions ---'
cat /tmp/coderabbit-repo-knowledge/hyperpolymath-contractiles-504e77ea/conventions/repo-wide.md
printf '%s\n' '--- SMTP secret and port references ---'
rg -n --hidden --glob '!/.git/**' 'SMTP_PORT|smtp-notify-action|secure:' .
printf '%s\n' '--- action contract at v0.1.0 ---'
curl -fsSL https://raw.githubusercontent.com/hyperpolymath/smtp-notify-action/v0.1.0/action.ymlRepository: hyperpolymath/contractiles Length of output: 4845 Use an implicit-TLS SMTP port. If 🧰 Tools🪛 zizmor (1.29.0)[error] 27-27: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy) (unpinned-uses) 🤖 Prompt for AI Agents🔒 Security & Privacy | 🟠 Major | ⚡ Quick win 🔎 Supported by static analysis🏁 Script executed: printf '%s\n' '--- applicable repository conventions ---'
find /tmp/coderabbit-repo-knowledge/hyperpolymath-contractiles-504e77ea -maxdepth 2 -type f -name '*.md' -print
printf '%s\n' '--- workflow ---'
cat -n .github/workflows/push-email-notify.yml
printf '%s\n' '--- lock entry ---'
sed -n '105,120p' .github/workflows/actions.lock
printf '%s\n' '--- relevant convention files ---'
for f in /tmp/coderabbit-repo-knowledge/hyperpolymath-contractiles-504e77ea/*/*.md; do
case "$f" in *workflow*|*action*|*security*|*github*) printf '\n### %s\n' "$f"; cat "$f";; esac
doneRepository: hyperpolymath/contractiles Length of output: 5813 🏁 Script executed: # Resolve the declared tag and candidate SHA without changing repository files.
set -o pipefail
printf '%s\n' '--- tag resolution ---'
git ls-remote --tags https://github.com/hyperpolymath/smtp-notify-action.git 'refs/tags/v0.1.0' 'refs/tags/v0.1.0^{}'
printf '%s\n' '--- candidate object resolution ---'
git ls-remote https://github.com/hyperpolymath/smtp-notify-action.git \
1b3b752d39a4fe4c0f28f10905e4608789d3e050Repository: hyperpolymath/contractiles Length of output: 342 🏁 Script executed: printf '%s\n' '--- repository-wide conventions ---'
cat /tmp/coderabbit-repo-knowledge/hyperpolymath-contractiles-504e77ea/conventions/repo-wide.md
printf '%s\n' '--- machine-readable conventions ---'
cat /tmp/coderabbit-repo-knowledge/hyperpolymath-contractiles-504e77ea/conventions/machine-readable.mdRepository: hyperpolymath/contractiles Length of output: 772 🌐 Web query:
💡 Result: Pinning GitHub Actions to a full-length (40-character) commit SHA is the recommended practice for ensuring the immutability of third-party actions, as it ensures the workflow executes the exact, reviewed code regardless of changes made to tags or branches in the upstream repository [1][2][3]. Key security considerations include: - Immutability: Unlike tags or branches, which are mutable and can be moved or deleted by a maintainer or an attacker, a full-length commit SHA provides a content-addressed, immutable reference [4][3][5]. Pinning to a SHA mitigates risks associated with supply chain attacks, such as malicious code injection into a version tag [1][6]. - Requirement: You must use the full 40-character SHA, not an abbreviated one [4][5]. - Policy Enforcement: GitHub allows administrators to enforce this practice at the repository, organization, and enterprise levels through the allowed actions policy [1][7][6]. When enabled, any workflow attempting to use an action not pinned to a full commit SHA will fail [6]. - Maintenance: Because SHA pinning prevents automatic updates, it is recommended to use dependency management tools like Dependabot or Renovate to help keep pinned SHAs current, allowing for deliberate and reviewed updates [3][5][8]. - Trust: While pinning to tags is a common convenience, GitHub documentation advises only doing so if you fully trust the action's creator [1][7]. The verified creator badge can be a helpful, though not exhaustive, indicator of trust [1][2]. For further implementation details, you can consult the official documentation on secure use of GitHub Actions [1] and the guidance on managing custom actions [4]. Citations:
Use the immutable commit SHA in
Proposed fix- uses: hyperpolymath/smtp-notify-action@v0.1.0 # NOSONAR — pin authority is actions.lock (sha1-1b3b752d39a4fe4c0f28f10905e4608789d3e050)
+ uses: hyperpolymath/smtp-notify-action@1b3b752d39a4fe4c0f28f10905e4608789d3e050 # v0.1.0📝 Committable suggestion
Suggested change
🧰 Tools🪛 zizmor (1.29.0)[error] 27-27: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy) (unpinned-uses) 🤖 Prompt for AI AgentsSource: Linters/SAST tools |
||||||
| with: | ||||||
| server_address: ${{ secrets.SMTP_HOST }} | ||||||
| server_port: ${{ secrets.SMTP_PORT }} | ||||||
|
|
||||||
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win
🔎 Supported by static analysis
🏁 Script executed:
Repository: hyperpolymath/contractiles
Length of output: 26457
🌐 Web query:
site:docs.github.com GitHub Actions push event branch deletion branches filter workflow deleted branch💡 Result:
GitHub Actions does not provide a direct mechanism to filter or specifically trigger a workflow based on branch deletion within the push event configuration [1][2]. The push event in GitHub Actions does indeed include branch deletion as a type of activity [2], but it is primarily designed to handle code updates. While you can detect if a push event involved a deletion by inspecting the webhook payload (which includes a 'deleted' boolean field) [2], the standard workflow syntax for filtering by branches (using 'branches' or 'branches-ignore') is intended to target the branch itself when code is pushed [1][3][4]. If you need to execute a workflow specifically when a branch is deleted, the standard and supported approach is to use the 'delete' event [5][6]: on: delete: Key considerations for this approach: - The 'delete' event triggers when a Git branch or tag is deleted [2][5][6]. - A workflow using the 'delete' event will only trigger if the workflow file exists on the default branch of the repository [5][6]. - You cannot use standard branch filters (like 'branches' or 'branches-ignore') with the 'delete' event, as these filters are specific to events like 'push' and 'pull_request' that act upon existing branch references [1][4][7]. If you need to restrict which branches trigger a 'delete' event workflow, you must implement logic within the job steps using the GitHub Actions context, for example by checking the 'github.event.ref' value to see which branch was deleted.
Citations:
🌐 Web query:
site:docs.github.com/en/actions/reference/workflows-and-actions/events-that-trigger-workflows push branch deleted github.event.deleted branches filter ref💡 Result:
When you delete a branch, GitHub Actions may trigger a push event, but the behavior is specific: the SHA and ref associated with the workflow run revert to the repository's default branch [1]. Because the push event technically updates the ref to the default branch, branch-specific filters (such as branches or branches-ignore) will evaluate based on that default branch context rather than the deleted branch [1]. If you need to specifically handle the deletion of a branch, you should use the delete event instead of the push event [1]. The delete event triggers specifically when a Git reference, such as a branch or tag, is deleted [1]. Note that the delete event only triggers if the workflow file exists on the default branch [1]. To implement a workflow that runs on branch deletion, you can configure it as follows [1]: on: delete You can further inspect the details of the deleted reference within the workflow by accessing the github.event payload, which provides information about the deleted reference [1]. Filters like branches do not apply to the delete event in the same way they apply to push events [1].
Citations:
Exclude branch deletion events from the notification job.
GitHub can emit a
pushevent for a branch deletion. Thebranches: ['**']filter can match that event through the default branch context, so the current job condition can send an invalid notification. Add&& !github.event.deletedto the job condition.🧰 Tools
🪛 zizmor (1.29.0)
[warning] 13-16: insufficient job-level concurrency limits (concurrency-limits): workflow is missing concurrency setting
(concurrency-limits)
🤖 Prompt for AI Agents