From 03a02a49409134de07636216fb379a026c52991e Mon Sep 17 00:00:00 2001
From: Bernhard <48006183+furtber@users.noreply.github.com>
Date: Thu, 10 Sep 2026 19:57:59 +0200
Subject: [PATCH] Add require_tls input to prevent STARTTLS fallback to plain
 text (#317)

Expose nodemailer's requireTLS option so that when secure is false
(e.g. STARTTLS on port 587), the connection aborts if the server
does not support/negotiate STARTTLS, instead of silently sending
credentials in clear text.
---
 README.md  | 6 ++++++
 action.yml | 3 +++
 main.js    | 2 ++
 3 files changed, 11 insertions(+)

diff --git a/README.md b/README.md
index 9981f70a..a987060c 100644
--- a/README.md
+++ b/README.md
@@ -37,6 +37,12 @@ Some features:
     # Optional whether this connection use TLS (default is true if server_port is 465)
     secure: true
 
+    # Optional: when secure is false (e.g. STARTTLS on port 587), abort the
+    # connection if the server does not support/negotiate STARTTLS, instead
+    # of silently falling back to a plain text connection. Recommended
+    # whenever secure is false and you authenticate with username/password.
+    require_tls: true
+
     # Optional (recommended) mail server username:
     username: ${{secrets.MAIL_USERNAME}}
 
diff --git a/action.yml b/action.yml
index c0bf6a65..38a25422 100644
--- a/action.yml
+++ b/action.yml
@@ -14,6 +14,9 @@ inputs:
     default: "25"
   secure:
     description: Whether this connection use TLS (default is true if server_port is 465)
+  require_tls:
+    description: When 'secure' is false, refuse to send if the server does not support STARTTLS (prevents credentials from ever being sent in clear text)
+    required: false
   username:
     description: Authenticate as this user to SMTP server
   password:
diff --git a/main.js b/main.js
index 4b65f4aa..9751990a 100644
--- a/main.js
+++ b/main.js
@@ -94,6 +94,7 @@ async function main() {
         let serverAddress = core.getInput("server_address");
         let serverPort = core.getInput("server_port");
         let secure = core.getInput("secure");
+        const requireTLS = core.getInput("require_tls", { required: false });
         let username = core.getInput("username");
         let password = core.getInput("password");
 
@@ -196,6 +197,7 @@ async function main() {
                     : undefined,
             port: serverPort,
             secure: secure === "true",
+            requireTLS: requireTLS === "true",
             tls:
                 ignoreCert == "true"
                     ? {