Repository navigation
deed: correct the deed to the Mathesis identity (re-anchoring WO 3.1) #222
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # This workflow is managed by gh actions-lock. | |
| # SPDX-License-Identifier: MPL-2.0 | |
| # Dormant push-email notification. ARMED by setting the repo variable | |
| # PUSH_EMAIL_ENABLED=true (the single on/off switch). Addresses are pre-filled; | |
| # sending needs the org SMTP secrets (SMTP_HOST/PORT/USER/PASS). Inherited by | |
| # new repos from the template; placed on existing repos by the farm sweep. | |
| # | |
| # Re-landed after the 2026-07-20 notification-storm freeze (removed in | |
| # 09f94c5), now on hyperpolymath/smtp-notify-action: Node-free, the SMTP | |
| # session is Idris2-specified and machine-checked, the binary is Zig-built, | |
| # byte-reproducible, and SHA-256-pinned inside the action itself. | |
| name: Push email notification | |
| on: | |
| push: | |
| # Branch pushes only; the job condition separately excludes branch deletions. | |
| branches: ['**'] | |
| concurrency: | |
| # Deliberately per-RUN, so no run is ever queued behind another and none is | |
| # ever cancelled. Do NOT "tidy" this into a shared group such as | |
| # ${{ github.workflow }}-${{ github.ref }}. GitHub's workflow-syntax docs: | |
| # "By default, any existing pending job or workflow in the same concurrency | |
| # group will be canceled and the new queued job or workflow will take its | |
| # place." That happens regardless of cancel-in-progress, which governs only | |
| # the RUNNING job. On this workflow it silently loses a notification email, | |
| # with no error anywhere. Every run here reports a DISTINCT commit, so there | |
| # is no redundant work for a concurrency limit to remove. | |
| # The docs also offer `queue: max` (up to 100 pending); not used, because 100 | |
| # is still a cap whereas a per-run group needs none. | |
| # Verified with zizmor 1.30.0: deleting this block raises concurrency-limits; | |
| # this form silences it exactly as a shared group would. | |
| group: push-email-${{ github.run_id }}-${{ github.run_attempt }} | |
| cancel-in-progress: false | |
| permissions: {} | |
| jobs: | |
| notify: | |
| name: Email on push | |
| if: ${{ vars.PUSH_EMAIL_ENABLED == 'true' && github.event.deleted != true }} | |
| runs-on: ubuntu-24.04 | |
| timeout-minutes: 5 | |
| steps: | |
| - name: Send push notification email | |
| uses: hyperpolymath/smtp-notify-action@v0.5.1 # NOSONAR — pin authority is actions.lock (sha1-22e7bdb322c430c1d0dac6b3bb307f4bb139d0be) | |
| with: | |
| server_address: ${{ secrets.SMTP_HOST }} | |
| server_port: ${{ secrets.SMTP_PORT }} | |
| # Standard submission uses mandatory STARTTLS; other ports retain implicit TLS. | |
| secure: ${{ secrets.SMTP_PORT == '587' && 'starttls' || 'implicit' }} | |
| username: ${{ secrets.SMTP_USER }} | |
| password: ${{ secrets.SMTP_PASS }} | |
| from: "GitHub Push <${{ secrets.SMTP_USER }}>" | |
| to: "jonathan.jewell@gmail.com j.d.a.jewell@open.ac.uk" | |
| subject: "[${{ github.repository }}] push to ${{ github.ref_name }} by ${{ github.actor }}" | |
| body: | | |
| Repository: ${{ github.repository }} | |
| Branch: ${{ github.ref_name }} | |
| Pusher: ${{ github.actor }} | |
| Compare: ${{ github.event.compare }} | |
| Head msg: ${{ github.event.head_commit.message }} |