push-email-notify.yml

# SPDX-License-Identifier: MPL-2.0
# This workflow is managed by gh actions-lock.
# Dormant push-email notification. ARMED by setting the repo variable
# PUSH_EMAIL_ENABLED=true (the single on/off switch). Addresses are pre-filled;
# sending needs the org SMTP secrets (SMTP_HOST/PORT/USER/PASS). Inherited by
# new repos from the template; placed on existing repos by the farm sweep.
#
# Re-landed after the 2026-07-20 notification-storm freeze (removed in
# 09f94c5), now on hyperpolymath/smtp-notify-action: Node-free, the SMTP
# session is Idris2-specified and machine-checked, the binary is Zig-built,
# byte-reproducible, and SHA-256-pinned inside the action itself.
name: Push email notification
on:
  push:
    # Branch pushes only: tag and deletion payloads mislabel Branch:/head_commit.
    branches: ['**']
permissions:
  contents: read
jobs:
  notify:
    name: Email on push
    if: ${{ vars.PUSH_EMAIL_ENABLED == 'true' }}
    runs-on: ubuntu-latest
    timeout-minutes: 5
    steps:
      - name: Send push notification email
        uses: hyperpolymath/smtp-notify-action@v0.1.0 # NOSONAR — pin authority is actions.lock (sha1-1b3b752d39a4fe4c0f28f10905e4608789d3e050)
        with:
          server_address: ${{ secrets.SMTP_HOST }}
          server_port: ${{ secrets.SMTP_PORT }}
          secure: true
          username: ${{ secrets.SMTP_USER }}
          password: ${{ secrets.SMTP_PASS }}
          from: "GitHub Push <${{ secrets.SMTP_USER }}>"
          to: "jonathan.jewell@gmail.com j.d.a.jewell@open.ac.uk"
          subject: "[${{ github.repository }}] push to ${{ github.ref_name }} by ${{ github.actor }}"
          body: |
            Repository: ${{ github.repository }}
            Branch:     ${{ github.ref_name }}
            Pusher:     ${{ github.actor }}
            Compare:    ${{ github.event.compare }}
            Head msg:   ${{ github.event.head_commit.message }}