[hyperpolymath]

Summary

Closes #108.

Dependabot #106 moved .github/workflows/push-email-notify.yml to hyperpolymath/smtp-notify-action@v0.5.0 but left actions.lock pinning v0.3.0. Since then, the check actions.lock is in sync with the workflow YAML has failed on main and on every PR. This PR regenerates the lockfile so it matches the workflow, and changes nothing else.

Type of change

CI lockfile sync. No workflow, registry or package content changes.

📌 New pins

Head SHA: 8239999

• actions.lock: hyperpolymath/smtp-notify-action@v0.5.0 → sha1-c1c9fa07992a02c1fd3d67a0dc1b08cccb852aef. This is the commit the v0.5.0 tag peels to (git ls-remote … refs/tags/v0.5.0^{}), not the tag object c6a2a6dc.
• Removed: hyperpolymath/smtp-notify-action@v0.3.0 → sha1-22e7bdb3…. No workflow references it any more.
• The action is using: composite at v0.5.0 with no nested uses:, so it adds no transitive pins.

Changes

• .github/workflows/actions.lock: in the push-email-notify.yml list and the dependencies: table, v0.3.0 → v0.5.0. Generated by gh actions-lock, not hand-edited.

RSR Quality Checklist

Required

• No banned language patterns. Only the lockfile changes.
• SPDX license headers: not applicable. actions.lock is a machine-generated file that has never carried a header, and no source file is touched.
• No secrets, credentials, or .env files included.
• CI is green: not claimed yet. This PR should turn actions.lock is in sync with the workflow YAML green. The two governance reds on main (Workflow security linter, Allowlist Preflight) are deferred to CI: governance linter calls a missing scripts/update-actions-lock.sh; Allowlist Preflight runs with an empty GH_TOKEN #105 and unaffected by this PR.

As Applicable — Registry Changes

• Registry.toml: not applicable, no package or version changes.
• Per-package TOML files: not applicable, none touched.
• Upstream quality bar: not applicable, no registration.
• Upstream tag: not applicable, no registration.

As Applicable — Documentation / Infra Changes

• .machine_readable/6a2/*.a2ml: not applicable. A2ML is retired estate-wide (D99, D269c).
• TOPOLOGY.md: not applicable, no architecture change.
• CHANGELOG.md: not touched. The commit is a conventional fix(ci):.
• Wiki: not applicable, nothing user-facing.

Testing

• gh actions-lock --no-fix on origin/main (4141456): fails with workflow uses ref "v0.5.0" but lockfile pins "v0.3.0" and Unused lockfile entry hyperpolymath/smtp-notify-action@v0.3.0. On this head it exits 0.
• bash scripts/check-lock-sync.sh on this head exits 0. It confirms every uses: is locked under its own workflow path, every lockfile entry is still referenced, 0 dangling edges, and every workflow file has a lockfile key.
• Fix-mode gh actions-lock also tried to prepend its managed by gh actions-lock header to lock-sync-gate.yml. That edit was reverted to keep this PR lock-only, and --no-fix still exits 0 without it.
• Commit signature: git log --format=%G? → G (SSH-signed).

Deferred red checks

Both checks are red on main too. This PR does not touch them.

• governance / Workflow security linter: deferred to CI: governance linter calls a missing scripts/update-actions-lock.sh; Allowlist Preflight runs with an empty GH_TOKEN #105. The linter calls a missing scripts/update-actions-lock.sh.
• governance / Allowlist Preflight: deferred to CI: governance linter calls a missing scripts/update-actions-lock.sh; Allowlist Preflight runs with an empty GH_TOKEN #105. It runs with an empty GH_TOKEN.

Merge

Squash. Auto-merge is not armed; this registry PR is for the owner's review.

🤖 Generated with Claude Code

https://claude.ai/code/session_016XJoh8YA2sCWQmq93CF8RX

[coderabbitai]

Important

Review skipped

Review was skipped due to path filters

⛔ Files ignored due to path filters (1)

• .github/workflows/actions.lock is excluded by !**/*.lock

---

CodeRabbit blocks several paths by default. You can override this behavior by explicitly including those paths in the path filters. For example, including **/dist/** will override the default block on the dist directory, by removing the pattern from both the lists.

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: 41b8c625-c551-4f54-93f5-16844ed2b872

---

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

---

_{Comment @coderabbitai help to get the list of available commands.}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud