fix: exclude system.site mail_notification by default

[Decipher]

Summary

system.site:mail_notification sat next to the excluded system.site:mail and was exposed by default to anyone holding read decoupled settings.

Changes

• config/install/decoupled_settings.settings.yml: system.site:mail_notification joins the shipped exclusions.
• decoupled_settings.install: decoupled_settings_update_10001() appends the key for existing installs, once, and leaves a site free to remove it again.
• tests/src/Kernel/SettingsResolverTest.php: the default-exclusion assertion now covers both address keys, and a new test drives the update hook from the pre-fix state, including idempotence.
• README.md: the features line names both excluded addresses.

Summary by CodeRabbit

• Security & Privacy

  • Site notification email addresses are now excluded by default from exposed settings, alongside the site email address.

• Bug Fixes

  • Existing installations automatically receive the new exclusion during update.
  • Forms now correctly display an empty inherited value when no value is available.

• Documentation

  • Updated feature documentation to reflect the expanded email-address exclusions.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 363da9d5-5a1d-49f6-9d26-e2560863648c

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 10f90340-689e-4371-9eb8-775bee114d29

📥 Commits

Reviewing files that changed from the base of the PR and between 5465239 and 08eb704.

📒 Files selected for processing (5)

• README.md
• config/install/decoupled_settings.settings.yml
• decoupled_settings.install
• tests/src/Kernel/FormLogicTest.php
• tests/src/Kernel/SettingsResolverTest.php

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

The change excludes system.site:mail_notification by default, migrates existing configurations through update hook 10001, updates documentation, and adds kernel coverage for exclusion, idempotency, and NULL form values.

Changes

Notification email exclusion

Layer / File(s)	Summary
Exclusion defaults and update hook config/install/decoupled_settings.settings.yml, decoupled_settings.install, README.md	The default configuration excludes system.site:mail_notification. Update hook 10001 adds the key to existing configurations without duplication. Documentation lists both email settings.
Resolver and form validation tests/src/Kernel/SettingsResolverTest.php, tests/src/Kernel/FormLogicTest.php	Kernel tests verify that the notification email is not exposed, the update hook is idempotent, and a NULL inherited value renders as an empty cell.

Estimated code review effort: 2 (Simple) | ~10 minutes

Merge Risk: ⚪ Minimal · up to 08eb7

The change narrowly excludes the additional system-site email setting by default and updates existing installations with idempotent coverage; no actionable merge-blocking risk remains beyond normal checks and review.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 5 functions across 2 files. (3 skipped: 3 …
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: excluding system.site:mail_notification by default.

Full details: Docstring Coverage

Explanation

Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 5 functions across 2 files. (3 skipped: 3 unsupported.)

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feature/2-exclude-mail-notification

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 85.86%. Comparing base (497d155) to head (4a406de).

Additional details and impacted files

@@                        Coverage Diff                        @@
##           feature/1-page-cache-path-prefix       #6   +/-   ##
=================================================================
  Coverage                             85.86%   85.86%           
=================================================================
  Files                                     9        9           
  Lines                                   481      481           
=================================================================
  Hits                                    413      413           
  Misses                                   68       68           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[Decipher]

@coderabbitai review

[coderabbitai]

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.