Prompt
Workflow: on release published, run socialhandoff-announce-action with the three repository secrets. Release rule in Connections targets mastodon only, with approval required. Maintainers review the draft in the inbox and add a CW if the notes are long.How to do it
- Connect Mastodon and add a release rule In https://app.socialhandoff.com, connect Mastodon, then add a GitHub trigger in Connections with a release rule that targets Mastodon. Copy the trigger id and signing secret.
- Store the secrets Add your instance URL, the trigger id, and the signing secret as repository secrets.
- Add the workflow Create a workflow on: release with types [published] that runs socialhandoff-announce-action. The action signs the payload with HMAC-SHA256 and sends tag, name, notes, and URL.
- Approve the draft Publish a release. A Mastodon draft appears in the inbox with a citation back to the release, and publishes only after you approve it.
Example draft
Released: linthaus 0.14.0 New rule: no-unused-imports, with an autofix. The config loader now accepts linthaus.config.ts. Plus 11 bug fixes from 6 contributors. Full notes: github.com/acme/linthaus/releases/tag/v0.14.0 #JavaScript #OpenSource
Gotchas
- Use CamelCase hashtags such as #OpenSource so screen readers say them correctly, and a content warning for long logs or spoilers.
- 500 characters is only the default. Many instances allow more or less, so set the per-network length guardrail to your server's real limit.
- Publishing uses idempotency keys, so a retried request after a timeout does not produce a duplicate toot.
- The action sends the release, not a finished post. Mastodon as a target and the approval rule live on the release rule in Connections, not in the workflow file.
- Character limit: 500 characters on a default Mastodon server. Each instance can raise it, so check yours.
- Links: Every URL counts as 23 characters, however long it is.
- Media per post: Up to 4 attachments on a default server.
- File sizes: Images up to 16 MB and video up to about 99 MB on a default install. Instances can set their own limits.
Frequently asked questions
Does the action need an agent key?
No. It uses the trigger id and a signing secret, and the request is verified with HMAC-SHA256. The draft is attributed to the release in the audit log.
Will a re-run workflow post the release twice to Mastodon?
Duplicate protection covers the publish step, and every draft still needs approval, so a re-run shows up as a second draft you can reject.
Can I post to several fediverse accounts at once?
Yes. Connect each Mastodon account, and a single draft can target several. Each target is published and retried on its own.