chore(deps): bump hyperpolymath/smtp-notify-action from 0.1.0 to 0.2.0 in the actions group

[dependabot]

Bumps the actions group with 1 update: hyperpolymath/smtp-notify-action.

Updates hyperpolymath/smtp-notify-action from 0.1.0 to 0.2.0

Release notes

Sourced from hyperpolymath/smtp-notify-action's releases.

v0.2.0

Static, byte-reproducible smtp-notify binaries. CI rebuilt them from this tag and verified they hash to exactly the SHA-256 pins inside this tag's action.yml before publishing.

Changelog

Sourced from hyperpolymath/smtp-notify-action's changelog.

== v0.2.0 — 2026-09-03

[IMPORTANT]

Upgrading from v0.1.0 changes behaviour. secure is now fail-closed: a value this action does not recognise is rejected instead of being treated as plaintext. A workflow that passed secure: false expecting dawidd6's "STARTTLS when the server offers it" now fails with a message naming the cause, rather than downgrading to cleartext. Sending in the clear requires typing plaintext. See MIGRATION.adoc.

This release also closes the v0.1.0 window described in the previous edition of this file: action.yml here downloads the v0.2.0 binaries and carries their SHA-256 pins, so the behaviour described below is the behaviour that runs.

=== Changed

• secure is now fail-closed. Transport selection accepts true/implicit (SMTPS), false/starttls, and plaintext. Any other value is rejected outright. false fails with a clear message because STARTTLS is not yet implemented, rather than silently downgrading. This is a deliberate incompatibility with dawidd6/action-send-mail, where false means "STARTTLS when the server offers it"; previously an unrecognised value here meant plaintext.
• Sending in the clear now requires typing plaintext explicitly.

=== Added

• Runner OS gate, checked before the architecture gate. Windows and Intel macOS both report x86_64 from uname -m, so an architecture-only gate downloaded the Linux binary, passed the SHA-256 check because the file was intact, and then died at exec with a confusing exec-format error. The failure now names the real cause.
• Whole-run watchdog, bounding connection, TLS handshake, and every read and write, exposed as timeout_seconds (default 60). It replaces a per-operation connect deadline that Zig 0.16.0 cannot honour — see BUSTFILE.adoc, BUST-2026-001 and BUST-2026-002. It is a whole-run deadline, not an idle timer.
• BUSTFILE.adoc — defects in dependencies, each with a hazard-control disposition and a re-check trigger.
• KNOWN-DEFECTS.adoc — our own defects, published rather than waited upon, including the exact scope of the formal claims.
• MIGRATION.adoc — migration guide from dawidd6/action-send-mail with the full input compatibility table.
• Community health: .github/SECURITY.md and .github/CONTRIBUTING.md, and this changelog.

=== Fixed

• Server reply text is now surfaced in diagnostics, so a rejection says what the server said instead of only that it failed.
• CI: strip CRLF from the mailpit raw fetch before whole-line greps, which had

... (truncated)

Commits

• ede1191 docs: restore the "@​main is not a release" statement, and say why (#15)
• ea60deb release: v0.2.0 — action.yml fetches the fixed binaries (#14)
• 93ee757 docs: security policy, contributing guide and changelog (#13)
• 4077691 fix: fail-closed transport, OS gate, server reply text, whole-run watchdog (#12)
• 5730180 docs: defect registers — Bustfile (dependencies) and known defects (ours) (#11)
• f3d5c1a docs: migration guide from dawidd6/action-send-mail (#8)
• 6d6147e docs: describe the dawidd6 relationship honestly (#7)
• f9809b1 fix(ci): strip CRLF from mailpit raw fetch before whole-line greps
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 638246cf-8d1c-46e2-9658-b59da26a074c

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

📝 Summary

Summary by CodeRabbit

• Chores
  • Updated the push-email notification workflow to use a newer notification action version.

Walkthrough

The push-email notification workflow now uses hyperpolymath/smtp-notify-action@v0.2.0. The existing SHA-256 pin comment remains unchanged.

Changes

Push email notification

Layer / File(s)	Summary
Update SMTP action version .github/workflows/push-email-notify.yml	The workflow changes the SMTP notification action from v0.1.0 to v0.2.0 and retains the pin-authority comment.

Priority: ⬇️ Low

Estimated code review effort: 1 (Trivial) | ~2 minutes

Change: Other

Suggested reviewers: hyperpolymath

Merge Risk: 🟡 Moderate · up to 4128c

The SMTP action should be pinned to the v0.2.0 commit and its lock entry updated before merge.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and concisely describes the dependency update from hyperpolymath/smtp-notify-action 0.1.0 to 0.2.0.
Description check	✅ Passed	The description directly explains the dependency update and documents the important behavioural changes in version 0.2.0.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🛠️ Fix failing CI checks

• Create stacked PR
• Commit on current branch

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{A rabbit checks the workflow line
The SMTP action now hops to nine—
From v0.1.0 to v0.2.0 bright
The pin comment stays just right
Email springs through the burrow tonight}

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

✅ Coding Agent task started: View task and status

The task will inspect the CI failures, validate its fix, and commit the fix to this branch automatically.

Note: Fixing CI failures is a beta feature and may encounter errors. Expect some limitations and changes as we gather feedback and continue to improve it.

⏭️ 3 check(s) skipped — already failing on `main` (not caused by this PR)

• GitHub Actions: Deno CI / 0_deno-ci _ Deno CI.txt
• GitHub Actions: Governance / 1_governance _ Security policy checks.txt
• GitHub Actions: Governance / 2_governance _ Workflow security linter.txt

[coderabbitai]

⚠️ Coding task changes are ready, but delivery needs attention

Open the task to resolve the delivery issue or retry.

[hyperpolymath]

coderabbitai The action has been pinned to commit hash ede1191ef6ff3ac02c4f4d9efdf837ee517e11d7 and actions.lock has been updated. Please re-review.

All issues addressed - action pinned to commit hash

[hyperpolymath]

Approving after fixes: action pinned to commit hash ede1191ef6ff3ac02c4f4d9efdf837ee517e11d7