Nawid3333 · Nov 9, 2026 · Nov 9, 2026 · Nov 9, 2026
diff --git a/.github/actionlint.yaml b/.github/actionlint.yaml
@@ -1,11 +1,14 @@
 # Read by actionlint from here, in ci.yml's workflows job and in the WSL verify.
 #
 # GitHub's `vulnerability-alerts` permission (read the Dependabot alerts, which
-# security-alerts.yml needs) is newer than actionlint 1.7.12, the latest release; the
+# security-alerts.yml and daily-digest.yml need) is newer than actionlint 1.7.12, the latest release; the
 # request for it is rhysd/actionlint#666. Checked 2026-09-30: without it the token's
 # request for the alerts is refused (HTTP 403), with it they are listed. Drop this once
 # .github/actionlint/Dockerfile pins an actionlint that knows the permission.
 paths:
   .github/workflows/security-alerts.yml:
     ignore:
       - 'unknown permission scope "vulnerability-alerts"'
+  .github/workflows/daily-digest.yml:
+    ignore:
+      - 'unknown permission scope "vulnerability-alerts"'
diff --git a/.github/workflows/amo-signing-failsafe.yml b/.github/workflows/amo-signing-failsafe.yml
@@ -30,8 +30,8 @@ name: Release failsafe
 #      version and the add-on id. Broken: the issue "Update path broken: <tag>". A check
 #      the network stopped is not reported; the next run makes it again.
 #
-# Every issue is assigned to the owner and @mentions them, so it arrives by email; it is
-# opened once, and closed by the first run that finds it resolved. A run of this workflow
+# Every issue goes into the daily digest (daily-digest.yml), the owner's one email a day; it
+# is opened once, and closed by the first run that finds it resolved. A run of this workflow
 # that fails opens "Release failsafe failed" (the runs release.yml starts email no one).
 
 on:
@@ -61,7 +61,6 @@ jobs:
     timeout-minutes: 75
     env:
       GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-      OWNER: ${{ github.repository_owner }}
       SIGNING_PREFIX: 'AMO signing incomplete: '
       PATH_PREFIX: 'Update path broken: '
 
@@ -218,11 +217,11 @@ jobs:
           # The backticks are Markdown for the issue body, not command substitution.
           # shellcheck disable=SC2016
           {
-            printf '@%s %s is tagged but has no release: release.yml failed %s times for it, the last of them started by this failsafe. Firefox does not get this version until it is published.\n\n' "$OWNER" "$ORPHAN" "$attempts"
+            printf '%s is tagged but has no release: release.yml failed %s times for it, the last of them started by this failsafe. Firefox does not get this version until it is published.\n\n' "$ORPHAN" "$attempts"
             printf 'The runs: %s\n\n' "$runs_url"
             printf 'Fix what they report, then run release.yml for the tag again: `gh workflow run release.yml --ref %s`. This issue closes on its own once %s has its release.\n' "$ORPHAN" "$ORPHAN"
           } > "$RUNNER_TEMP/body.md"
-          gh issue create --repo "$GITHUB_REPOSITORY" --title "$title" --assignee "$OWNER" --body-file "$RUNNER_TEMP/body.md"
+          gh issue create --repo "$GITHUB_REPOSITORY" --title "$title" --body-file "$RUNNER_TEMP/body.md"
 
       # --- The latest release is complete: check the update path Firefox follows.
 
@@ -264,12 +263,12 @@ jobs:
           fi
           run_url="$GITHUB_SERVER_URL/$GITHUB_REPOSITORY/actions/runs/$GITHUB_RUN_ID"
           {
-            printf '@%s Firefox cannot update to %s: its update check follows the latest release'"'"'s updates.json, and a link on that path does not hold.\n\n' "$OWNER" "$TAG"
+            printf 'Firefox cannot update to %s: its update check follows the latest release'"'"'s updates.json, and a link on that path does not hold.\n\n' "$TAG"
             printf '```\n'
             cat "$RUNNER_TEMP/path.txt"
             printf '```\n\nThe run: %s\nThis issue closes on its own once a run finds the path whole.\n' "$run_url"
           } > "$RUNNER_TEMP/body.md"
-          gh issue create --repo "$GITHUB_REPOSITORY" --title "$title" --assignee "$OWNER" --body-file "$RUNNER_TEMP/body.md"
+          gh issue create --repo "$GITHUB_REPOSITORY" --title "$title" --body-file "$RUNNER_TEMP/body.md"
 
       # --- The latest release is incomplete: collect what AMO signed.
 
@@ -370,17 +369,17 @@ jobs:
           # The backticks are Markdown for the issue body, not command substitution.
           # shellcheck disable=SC2016
           {
-            printf '@%s %s has no signed xpi and updates.json yet, %s hours after it was published. AMO says: **%s**.\n\n' "$OWNER" "$TAG" "$AGE" "$STATE"
+            printf '%s has no signed xpi and updates.json yet, %s hours after it was published. AMO says: **%s**.\n\n' "$TAG" "$AGE" "$STATE"
             printf 'Until it does, Firefox finds no update: its update check reads the latest release'"'"'s updates.json.\n\n'
             printf -- '- `pending`: still in AMO review. This workflow keeps checking every 3 hours and closes this issue once it is attached.\n'
             printf -- '- `rejected`: AMO disabled or rejected the version. Look it up on the AMO developer hub; waiting will not help.\n'
             printf -- '- `error`: see the run: %s\n' "$run_url"
           } > "$RUNNER_TEMP/body.md"
-          gh issue create --repo "$GITHUB_REPOSITORY" --title "$title" --assignee "$OWNER" --body-file "$RUNNER_TEMP/body.md"
+          gh issue create --repo "$GITHUB_REPOSITORY" --title "$title" --body-file "$RUNNER_TEMP/body.md"
 
       # A failed run is emailed only to whoever started it: for the runs release.yml starts,
       # this repository's token, so no one; for the schedule, whoever last changed the cron
-      # line. One issue while it is open, assigned and @mentioning the owner, as the other
+      # line. One issue while it is open, which the daily digest lists, as the other
       # workflows do; a failure while it is open adds a comment to it.
       - name: Report this workflow's own failure
         if: failure()
@@ -393,10 +392,10 @@ jobs:
           number=$(gh issue list --repo "$GITHUB_REPOSITORY" --state open --limit 200 --json number,title \
             --jq '[.[] | select(.title == env.TITLE)][0].number // empty') || number=''
           if [ -n "$number" ]; then
-            printf '@%s Failed again: %s\n' "$OWNER" "$RUN_URL" > "$RUNNER_TEMP/comment.md"
+            printf 'Failed again: %s\n' "$RUN_URL" > "$RUNNER_TEMP/comment.md"
             gh issue comment "$number" --repo "$GITHUB_REPOSITORY" --body-file "$RUNNER_TEMP/comment.md"
             exit 0
           fi
-          printf '@%s amo-signing-failsafe.yml (Release failsafe) failed: %s\n\nThe run log names the failed command. Until it runs cleanly, a release that did not publish or sign, or a broken update path, may go unnoticed. Close this issue once it is fixed; a later failure opens a new one.\n' \
-            "$OWNER" "$RUN_URL" > "$RUNNER_TEMP/body.md"
-          gh issue create --repo "$GITHUB_REPOSITORY" --title "$TITLE" --assignee "$OWNER" --body-file "$RUNNER_TEMP/body.md"
+          printf 'amo-signing-failsafe.yml (Release failsafe) failed: %s\n\nThe run log names the failed command. Until it runs cleanly, a release that did not publish or sign, or a broken update path, may go unnoticed. Close this issue once it is fixed; a later failure opens a new one.\n' \
+            "$RUN_URL" > "$RUNNER_TEMP/body.md"
+          gh issue create --repo "$GITHUB_REPOSITORY" --title "$TITLE" --body-file "$RUNNER_TEMP/body.md"
diff --git a/.github/workflows/auto-release.yml b/.github/workflows/auto-release.yml
@@ -358,7 +358,7 @@ jobs:
           done
           exit 1
 
-      # A failed release: one issue while it is open, assigned and @mentioning the owner. A
+      # A failed release: one issue while it is open, which the daily digest lists. A
       # run ci.yml started emails no one. A run on CI's workflow_run event should email the
       # one who pushed, but no failed run there has ever shown it (none of 91 runs failed),
       # and a release missed in silence leaves main unreleased; so it reports too. A
@@ -370,7 +370,6 @@ jobs:
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           GH_REPO: ${{ github.repository }}
-          OWNER: ${{ github.repository_owner }}
           EVENT: ${{ github.event_name }}
           SELF_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
           TITLE: 'Auto release failed'
@@ -382,7 +381,7 @@ jobs:
           number=$(gh issue list --state open --limit 200 --json number,title \
             --jq '[.[] | select(.title == env.TITLE)][0].number // empty') || number=''
           if [ -n "$number" ]; then
-            printf '@%s Auto release failed again: %s\n' "$OWNER" "$SELF_URL" > "$RUNNER_TEMP/comment.md"
+            printf 'Auto release failed again: %s\n' "$SELF_URL" > "$RUNNER_TEMP/comment.md"
             gh issue comment "$number" --body-file "$RUNNER_TEMP/comment.md"
             exit 0
           fi
@@ -391,9 +390,9 @@ jobs:
           else
             what='A CI run on main that this repository started (a re-run, or a run for pushes that start none) did not lead to a release'
           fi
-          printf '@%s %s: %s\n\nThe CI run was red, or a release step failed; the log says which. main'"'"'s newest changes are not released until this is fixed. Close this issue once it is fixed; a failure while it is open adds a comment.\n' \
-            "$OWNER" "$what" "$SELF_URL" > "$RUNNER_TEMP/body.md"
-          gh issue create --title "$TITLE" --assignee "$OWNER" --body-file "$RUNNER_TEMP/body.md"
+          printf '%s: %s\n\nThe CI run was red, or a release step failed; the log says which. main'"'"'s newest changes are not released until this is fixed. Close this issue once it is fixed; a failure while it is open adds a comment.\n' \
+            "$what" "$SELF_URL" > "$RUNNER_TEMP/body.md"
+          gh issue create --title "$TITLE" --body-file "$RUNNER_TEMP/body.md"
 
   # Restarts a CI run on main that a later run cancelled (see the header). After every CI
   # push run on main ends, whatever it concluded, it finds the newest commit on main with a
@@ -434,7 +433,6 @@ jobs:
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           GH_REPO: ${{ github.repository }}
-          OWNER: ${{ github.repository_owner }}
           TITLE: 'CI on main needs a re-run'
         run: |
           set -euo pipefail
@@ -457,14 +455,14 @@ jobs:
             number=$(gh issue list --state open --limit 200 --json number,title \
               --jq '[.[] | select(.title == env.TITLE)][0].number // empty') || number=''
             if [ -n "$number" ]; then
-              printf '@%s CI on main for %s cannot finish either: %s. The run: %s\n' \
-                "$OWNER" "${sha:0:8}" "$1" "$GITHUB_SERVER_URL/$GH_REPO/actions/runs/$id" > "$RUNNER_TEMP/comment.md"
+              printf 'CI on main for %s cannot finish either: %s. The run: %s\n' \
+                "${sha:0:8}" "$1" "$GITHUB_SERVER_URL/$GH_REPO/actions/runs/$id" > "$RUNNER_TEMP/comment.md"
               gh issue comment "$number" --body-file "$RUNNER_TEMP/comment.md"
               exit 0
             fi
-            printf '@%s CI on main for %s cannot finish: %s. Its changes are not released until it passes.\n\nThe run: %s\n\nRe-run it from that page (a re-run you start releases as usual once it is green), or push. This issue closes on its own at the next green CI run on main.\n' \
-              "$OWNER" "${sha:0:8}" "$1" "$GITHUB_SERVER_URL/$GH_REPO/actions/runs/$id" > "$RUNNER_TEMP/body.md"
-            gh issue create --title "$TITLE" --assignee "$OWNER" --body-file "$RUNNER_TEMP/body.md"
+            printf 'CI on main for %s cannot finish: %s. Its changes are not released until it passes.\n\nThe run: %s\n\nRe-run it from that page (a re-run you start releases as usual once it is green), or push. This issue closes on its own at the next green CI run on main.\n' \
+              "${sha:0:8}" "$1" "$GITHUB_SERVER_URL/$GH_REPO/actions/runs/$id" > "$RUNNER_TEMP/body.md"
+            gh issue create --title "$TITLE" --body-file "$RUNNER_TEMP/body.md"
             exit 0
           }
           sha=''

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
@@ -527,7 +527,6 @@ jobs:
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           GH_REPO: ${{ github.repository }}
-          OWNER: ${{ github.repository_owner }}
           RUN_ID: ${{ github.run_id }}
           # A pull_request run's ref is the pull request's merge ref; its branch is head_ref.
           BRANCH: ${{ github.head_ref || github.ref_name }}
@@ -543,13 +542,13 @@ jobs:
           number=$(gh issue list --state open --limit 200 --json number,title \
             --jq '[.[] | select(.title == env.TITLE)][0].number // empty') || number=''
           if [ -n "$number" ]; then
-            printf '@%s GitHub refused three times again, for CI run %s on %s (%s): start update-prs.yml by hand with run_id %s and branch %s.\n' \
-              "$OWNER" "$RUN_ID" "$BRANCH" "$SELF_URL" "$RUN_ID" "$BRANCH" > "$RUNNER_TEMP/comment.md"
+            printf 'GitHub refused three times again, for CI run %s on %s (%s): start update-prs.yml by hand with run_id %s and branch %s.\n' \
+              "$RUN_ID" "$BRANCH" "$SELF_URL" "$RUN_ID" "$BRANCH" > "$RUNNER_TEMP/comment.md"
             gh issue comment "$number" --body-file "$RUNNER_TEMP/comment.md" || true
           else
-            printf '@%s GitHub refused three times to start update-prs.yml for CI run %s on %s (%s), a run this repository started, so that pull request waits without a word. Start it from the Actions tab: Update PRs, Run workflow, run_id %s and branch %s. Close this issue once it has run.\n' \
-              "$OWNER" "$RUN_ID" "$BRANCH" "$SELF_URL" "$RUN_ID" "$BRANCH" > "$RUNNER_TEMP/body.md"
-            gh issue create --title "$TITLE" --assignee "$OWNER" --body-file "$RUNNER_TEMP/body.md" || true
+            printf 'GitHub refused three times to start update-prs.yml for CI run %s on %s (%s), a run this repository started, so that pull request waits without a word. Start it from the Actions tab: Update PRs, Run workflow, run_id %s and branch %s. Close this issue once it has run.\n' \
+              "$RUN_ID" "$BRANCH" "$SELF_URL" "$RUN_ID" "$BRANCH" > "$RUNNER_TEMP/body.md"
+            gh issue create --title "$TITLE" --body-file "$RUNNER_TEMP/body.md" || true
           fi
           exit 1
 
@@ -586,7 +585,6 @@ jobs:
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           GH_REPO: ${{ github.repository }}
-          OWNER: ${{ github.repository_owner }}
           RUN_ID: ${{ github.run_id }}
           SHA: ${{ github.sha }}
           SELF_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
@@ -601,12 +599,12 @@ jobs:
           number=$(gh issue list --state open --limit 200 --json number,title \
             --jq '[.[] | select(.title == env.TITLE)][0].number // empty') || number=''
           if [ -n "$number" ]; then
-            printf '@%s GitHub refused three times to start auto-release.yml, for CI run %s on main (%s): %s. Start it from the Actions tab: Auto release, Run workflow, run_id %s.\n' \
-              "$OWNER" "$RUN_ID" "${SHA:0:8}" "$SELF_URL" "$RUN_ID" > "$RUNNER_TEMP/comment.md"
+            printf 'GitHub refused three times to start auto-release.yml, for CI run %s on main (%s): %s. Start it from the Actions tab: Auto release, Run workflow, run_id %s.\n' \
+              "$RUN_ID" "${SHA:0:8}" "$SELF_URL" "$RUN_ID" > "$RUNNER_TEMP/comment.md"
             gh issue comment "$number" --body-file "$RUNNER_TEMP/comment.md" || true
           else
-            printf '@%s GitHub refused three times to start auto-release.yml for CI run %s on main (%s), a run this repository started. Start it from the Actions tab: Auto release, Run workflow, run_id %s. Close this issue once it has run.\n' \
-              "$OWNER" "$RUN_ID" "${SHA:0:8}" "$RUN_ID" > "$RUNNER_TEMP/body.md"
-            gh issue create --title "$TITLE" --assignee "$OWNER" --body-file "$RUNNER_TEMP/body.md" || true
+            printf 'GitHub refused three times to start auto-release.yml for CI run %s on main (%s), a run this repository started. Start it from the Actions tab: Auto release, Run workflow, run_id %s. Close this issue once it has run.\n' \
+              "$RUN_ID" "${SHA:0:8}" "$RUN_ID" > "$RUNNER_TEMP/body.md"
+            gh issue create --title "$TITLE" --body-file "$RUNNER_TEMP/body.md" || true
           fi
           exit 1