From 49034466178be99fe370330411f8ae4e602505bd Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Wed, 2 Sep 2026 15:05:54 +0100 Subject: [PATCH 1/2] chore(ci): repoint push-email-notify to smtp-notify-action Replaces dawidd6/action-send-mail with hyperpolymath/smtp-notify-action v0.1.0 (1b3b752d39a4fe4c0f28f10905e4608789d3e050) per the 2026-09-02 ruling; file is the rsr-template-repo canonical (dormant gating on vars.PUSH_EMAIL_ENABLED unchanged). regime=lock pristine=valid fix-exit=1 post=valid changed=.github/workflows/actions.lock,.github/workflows/push-email-notify.yml, Co-Authored-By: Claude Fable 5.1 --- .github/workflows/actions.lock | 21 ++++++++++++++------- .github/workflows/push-email-notify.yml | 13 ++++++++++--- 2 files changed, 24 insertions(+), 10 deletions(-) diff --git a/.github/workflows/actions.lock b/.github/workflows/actions.lock index 26eefe5..793c643 100644 --- a/.github/workflows/actions.lock +++ b/.github/workflows/actions.lock @@ -3,16 +3,23 @@ # Docs: https://gh.io/actions-lockfile version: 'v0.0.2' workflows: + '.github/workflows/codeql.yml': + - 'actions/checkout@v4.1.1' '.github/workflows/governance.yml': [] '.github/workflows/hypatia-scan.yml': [] '.github/workflows/label-triage.yml': [] '.github/workflows/labels.yml': [] - '.github/workflows/secret-scanner.yml': [] '.github/workflows/push-email-notify.yml': - - 'dawidd6/action-send-mail@v3.12.0' + - 'hyperpolymath/smtp-notify-action@v0.1.0' + '.github/workflows/secret-scanner.yml': [] dependencies: - 'dawidd6/action-send-mail@v3.12.0': - ref: 'v3.12.0' - commit: 'sha1-6e502825a508b867ab2954ad6343b68787624c01' - owner_id: 9713907 - repo_id: 222439721 + 'actions/checkout@v4.1.1': + ref: 'v4.1.1' + commit: 'sha1-b4ffde65f46336ab88eb53be808477a3936bae11' + owner_id: 44036562 + repo_id: 197814629 + 'hyperpolymath/smtp-notify-action@v0.1.0': + ref: 'v0.1.0' + commit: 'sha1-1b3b752d39a4fe4c0f28f10905e4608789d3e050' + owner_id: 6759885 + repo_id: 1352485172 diff --git a/.github/workflows/push-email-notify.yml b/.github/workflows/push-email-notify.yml index 360340c..ece395b 100644 --- a/.github/workflows/push-email-notify.yml +++ b/.github/workflows/push-email-notify.yml @@ -4,20 +4,27 @@ # PUSH_EMAIL_ENABLED=true (the single on/off switch). Addresses are pre-filled; # sending needs the org SMTP secrets (SMTP_HOST/PORT/USER/PASS). Inherited by # new repos from the template; placed on existing repos by the farm sweep. +# +# Re-landed after the 2026-07-20 notification-storm freeze (removed in +# 09f94c5), now on hyperpolymath/smtp-notify-action: Node-free, the SMTP +# session is Idris2-specified and machine-checked, the binary is Zig-built, +# byte-reproducible, and SHA-256-pinned inside the action itself. name: Push email notification on: - push: {} + push: + # Branch pushes only: tag and deletion payloads mislabel Branch:/head_commit. + branches: ['**'] permissions: - actions: read contents: read jobs: notify: name: Email on push if: ${{ vars.PUSH_EMAIL_ENABLED == 'true' }} runs-on: ubuntu-latest + timeout-minutes: 5 steps: - name: Send push notification email - uses: dawidd6/action-send-mail@v3.12.0 + uses: hyperpolymath/smtp-notify-action@v0.1.0 # NOSONAR — pin authority is actions.lock (sha1-1b3b752d39a4fe4c0f28f10905e4608789d3e050) with: server_address: ${{ secrets.SMTP_HOST }} server_port: ${{ secrets.SMTP_PORT }} From d3a2c9566b65a163c9d0bebde4401c6f7422208f Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Wed, 2 Sep 2026 18:16:28 +0100 Subject: [PATCH 2/2] fix(ci): restore actions.lock to its main-branch key set gh actions-lock fix mode added a .github/workflows/codeql.yml entry listing only actions/checkout, omitting the three github/codeql-action pins it could not resolve, and exited 1. GitHub rejected the result with 'Invalid lockfile' and codeql.yml startup_failured (run 33640413755). The lock now matches main exactly apart from the dawidd6 to smtp-notify-action swap this PR is for. Co-Authored-By: Claude Fable 5.1 --- .github/workflows/actions.lock | 9 +-------- 1 file changed, 1 insertion(+), 8 deletions(-) diff --git a/.github/workflows/actions.lock b/.github/workflows/actions.lock index 793c643..ec133c9 100644 --- a/.github/workflows/actions.lock +++ b/.github/workflows/actions.lock @@ -3,21 +3,14 @@ # Docs: https://gh.io/actions-lockfile version: 'v0.0.2' workflows: - '.github/workflows/codeql.yml': - - 'actions/checkout@v4.1.1' '.github/workflows/governance.yml': [] '.github/workflows/hypatia-scan.yml': [] '.github/workflows/label-triage.yml': [] '.github/workflows/labels.yml': [] + '.github/workflows/secret-scanner.yml': [] '.github/workflows/push-email-notify.yml': - 'hyperpolymath/smtp-notify-action@v0.1.0' - '.github/workflows/secret-scanner.yml': [] dependencies: - 'actions/checkout@v4.1.1': - ref: 'v4.1.1' - commit: 'sha1-b4ffde65f46336ab88eb53be808477a3936bae11' - owner_id: 44036562 - repo_id: 197814629 'hyperpolymath/smtp-notify-action@v0.1.0': ref: 'v0.1.0' commit: 'sha1-1b3b752d39a4fe4c0f28f10905e4608789d3e050'