goldnead/statamic-automations
A lightweight Statamic addon for event-driven automations. Build rules that trigger on content saves, form submissions, or schedules, then run notifications, webhooks, and custom jobs—all configurable from the control panel, with support for your own custom triggers and actions.
send_email mails for the Flow Canvas mail tile (introduced in 2.28.0). The prior assessment's core capability—the entitlements.check_access flow node—is unchanged and still the main TPM lever for gated sequences, trial/grace workflows, and revocations. The thumbnail renderer is an authoring/UX concern, not a runtime automation concern, and should be evaluated and owned separately.goldnead/statamic-flow-canvas ^1.6.1. That version moves canvas components from Tailwind utilities to plain CSS, which is a positive for standalone installs but is a compatibility surface for anyone who has overridden those utility classes or shipped custom canvas styling. No migration. The thumbnail path additionally requires a Chromium binary and a writable thumbnail location in every environment where the canvas should preview mail—not just where flows execute.automations/thumbs/{uuid}/ directories? Will automations.thumbnails.* config be picked up under config:cache, and is STATAMIC_AUTOMATIONS_NO_SANDBOX acceptable to set only as a documented break-glass? If the app's assets live on a CDN or a different host than the app, will thumbnails render blank because the allow-list is host-scoped? Does the ^1.6.1 constraint conflict with any pinned addon versions, and who reviews canvas styling overrides after the Tailwind-to-CSS move? What are the per-render CPU/memory costs and concurrency limits on the workers that draw thumbnails? Does deleting thumbnails conflict with any retention, audit, or export expectations? And still open from prior releases: the exact Laravel/Statamic/PHP support matrix, stop-vs-fail semantics and replay for the entitlements node, and address-resolution behavior for multiple subjects.goldnead/statamic-flow-canvas ^1.6.1 bump first and confirm canvas styling renders correctly, particularly any custom or overridden component classes. Then verify Chromium availability and the thumbnail storage target per environment, review the new automations.thumbnails.timeout value against real mail weight, and confirm whether the platform runs as root so the sandbox posture is known rather than assumed. Before enabling thumbnail deletion in production, sweep any pre-existing automations/thumbs/{uuid}/ directories left by earlier versions.goldnead/statamic-flow-canvas ^1.6.1, (4) Chromium binary and version, (5) config cache behavior for automations.thumbnails.* and the STATAMIC_AUTOMATIONS_NO_SANDBOX env var, and (6) storage driver support for thumbnail write and delete. The action's absence when entitlements is missing is still a deliberate guard that can cause staging/production drift; the thumbnail feature introduces an analogous drift risk where staging has Chromium and production does not.no_sandbox on a non-root user where it demonstrably refuses. (3) Render a battery of test mails—remote images, relative paths, file://, <base>, inline styles, @import, own-host images—and confirm blocked loads resolve to transparent pixels and no outbound requests leave the dead proxy. (4) Tune the timeout for the heaviest real mail. (5) Verify automation deletion removes both database and flat-file thumbnails and that the storage driver is covered. (6) Only then re-run the entitlements flow regression suite from the prior assessment (require/forbid across entitled, grace, expired, revoked, unknown) before promoting business-critical delayed automations.statamic-flow-canvas ^1.6.1, storage lifecycle for thumbnails, and periodic review of the sanitizer allow-list as the app's asset hosting changes. The de.json translation work and this release's cleanup remain low-risk.forbid behavior. Designers and content authors need the new expectation that thumbnails intentionally show blank/transparent pixels for external, relative, and file:// references, and that only same-host images appear—otherwise blank canvases will be raised as bugs. Infrastructure support needs the sandbox/root caveat written down so no_sandbox is not treated as a routine toggle.decide()), so validate query cost and caching for high-volume delayed flows. The thumbnail path scales differently: each render spawns a browser process with meaningful CPU and memory, bounded by automations.thumbnails.timeout (now 20s by default). Thumbnail generation should be treated as background/queued work with its own concurrency ceiling, kept off the request path where possible, and sized before enabling previews across large automation libraries.forbid failing closed. Thumbnail failure modes are new: Chromium absent or refusing to start with the sandbox (the root/container case), proxy or network policy conflicts, renders exceeding the reduced timeout, unwritable or unsupported storage driver, and deletion failing or covering only one driver. Failure to render a thumbnail should degrade to a missing preview, not break authoring—confirm that boundary. Irreversible thumbnail deletion on automation delete is a deliberate behavior change worth noting in any audit or recovery process. The translation and dependency-bump changes carry low runtime risk but a real visual-regression risk.require vs forbid, grace-period treatment, address-resolution testing, how to investigate failed nodes before enabling the action in revenue-impacting automations, and how to triage blank mail thumbnails as expected-or-defect.How can I help you explore Laravel packages today?