chore(ci): repoint push-email-notify to smtp-notify-action

[hyperpolymath]

Replaces dawidd6/action-send-mail with hyperpolymath/smtp-notify-action v0.2.0 (tag commit ede1191ef6ff3ac02c4f4d9efdf837ee517e11d7), per the 2026-09-02 ruling (standards spec §5.5/§9, PR hyperpolymath/standards#725). The whole file is replaced with the rsr-template-repo canonical, which — besides the uses: line — restricts the trigger to branch pushes (tag and deletion payloads mislabel Branch:/head_commit), sets timeout-minutes: 5, carries a deliberately per-run concurrency group, and grants only contents: read. How many of those are actual changes here depends on how far this repo's copy had drifted — read the diff, not this list. Dormant gating on vars.PUSH_EMAIL_ENABLED == 'true' is unchanged. Line 1 SPDX header kept as it was.

Engine: .git-private-farm/scripts/smtp-notify-sweep.sh. Verification for this repo: regime=no-lock changed=.github/workflows/push-email-notify.yml, sig=G 6377bda canon=543fc1474b54 base=main
(pristine/post = gh actions-lock --no-fix validity before/after; repair = the lock was already invalid before this change and is valid after it.)

🤖 Generated with Claude Code

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Team

Run ID: 6f1ad76e-163d-4a77-9e79-d987191ef57f

📥 Commits

Reviewing files that changed from the base of the PR and between b4f7602 and 6377bda.

📒 Files selected for processing (1)

• .github/workflows/push-email-notify.yml

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

📜 Recent review details

⏰ Context from checks skipped due to timeout. (9)

• GitHub Check: rust-ci / Detect Cargo.toml
• GitHub Check: scan / rust-secrets
• GitHub Check: scan / gitleaks
• GitHub Check: cargo test --features git-integration
• GitHub Check: hypatia / Hypatia Neurosymbolic Analysis
• GitHub Check: scan / shell-secrets
• GitHub Check: idris2 0.8.0 --build git-reticulator-proofs
• GitHub Check: estate-audit
• GitHub Check: CodeQL Analysis (actions, none)

🔇 Additional comments (2)

.github/workflows/push-email-notify.yml (2)

6-10: LGTM!

Also applies to: 13-15, 16-31, 32-33, 39-39

---

42-42: 🗄️ Data Integrity & Integration

Do not flag a TLS transport mismatch.

The previous action passed secure: true to Nodemailer, which uses implicit TLS. The replacement action also uses implicit TLS for secure: true; the claimed transport change is refuted.

---

📝 Summary

Summary by CodeRabbit

• Bug Fixes

  • Restored email notifications for branch pushes.
  • Improved notification reliability by ensuring workflow runs are not cancelled or held behind other runs.

• Security and Reliability

  • Reduced workflow permissions to the minimum required.
  • Added a five-minute execution limit and updated the email delivery service.

Walkthrough

The push-email workflow now runs for branch pushes only. Each run has independent concurrency settings, reduced permissions, and a five-minute timeout. The workflow uses a SHA-256-pinned SMTP notification action with unchanged email inputs.

Changes

Push email notification workflow

Layer / File(s)	Summary
Branch trigger and run controls .github/workflows/push-email-notify.yml	The workflow now excludes tag and deletion pushes. Each run uses its own concurrency group without cancellation.
Notification action and execution limits .github/workflows/push-email-notify.yml	The job has a five-minute timeout and uses the pinned hyperpolymath/smtp-notify-action. Existing with inputs remain unchanged.
Workflow permissions and documentation .github/workflows/push-email-notify.yml	The workflow grants only contents: read. Comments document the re-land and pinned action.

Estimated code review effort: 2 (Simple) | ~10 minutes

Merge Risk: ⚪ Minimal · up to 6377b

The workflow now sends branch-push notifications through the pinned SMTP action with reduced permissions and bounded execution time. No merge-blocking risk is identified.

Poem

A rabbit reads each line,
The patch grows clear beneath the moon,
Small changes hop in place,
Tests guard the garden path,
Reviews bloom before the dawn.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and concisely identifies the main change: replacing the push-email workflow action with smtp-notify-action.
Description check	✅ Passed	The description is directly related to the workflow changes and provides relevant implementation and verification details.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (1 skipped: 1 unsupported.)

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}