Repository navigation
tend check: configuration drift on diffplug/dormouse #1069
Description
tend check (tend 0.3.14, the pinned version) reports two FAILs on diffplug/dormouse. actions-event-policy is SKIP because the bot's token cannot read the Actions policies. Every other check passes.
tag-protection(FAIL): tend reports that the bot can create or repoint a tag and suggeststend check --fixto create an admin-gated all-tags ruleset.credential-environments(FAIL): tend reports thatblyg-publish,release-attest, andsecurity-audithave no required reviewers and admit tags, with no all-tags ruleset restricting tags to admins that it could verify. It also reports thathosted-release-taghas no required reviewers and is reached byworkflow_dispatch, so tend does not count its ref list as a gate.
These look like the check misreading this repository's layout, not real exposure. Tag protection is split across three rulesets, as docs/specs/security-ci.md requires. Tag operations covers ~ALL except refs/tags/hosted/** and blocks creation and update. Hosted tag creation and Hosted tag history cover refs/tags/hosted/**. The API reports current_user_can_bypass: never for the bot on all three. tend looks for a single all-tags ruleset, so it does not recognize the split. For hosted-release-tag, the only job using it (tag in .github/workflows/hosted-production.yml) needs: deploy, and deploy runs in hosted-production, which requires review from Ned or Edgar. A bot-fired dispatch therefore stops before the tag job. tend does not follow that needs chain.
Running tend check --fix as suggested would add an all-tags ruleset that also covers hosted/**. Unless the dormouse-hosted-tagger App were added as a bypass actor, that ruleset would block the App's tag creation. Adding the bypass would in turn break the security-ci.md rule that the App bypasses only Hosted tag creation. Two other ways to clear the FAILs: a tend change that unions tag rulesets and follows needs, or a required reviewer on hosted-release-tag, which the spec currently says requires no review. Filing upstream at max-sixty/tend needs a maintainer's go-ahead.
Last refreshed: 2026-10-16
Activity
dormouse-bot commentedon Oct 8, 2026
Both FAILs trace to yesterday's intended change to how Hosted tags are minted, not to drift. eb1129e moved Hosted tagging to the
dormouse-hosted-taggerApp, and the rulesets were reshaped to match:Hosted tag creationandHosted tag historywere created, andTag operationswas updated to excluderefs/tags/hosted/**. All three changes landed between 2026-10-07T20:28:32Z and 20:28:45Z. Once that exclusion landed, no single ruleset covered every tag. That is the shape tend'stag-protectionlooks for, andcredential-environmentsfails because it builds on that check for thev*-admitting environments.I checked the body's claims against the live repo and they hold:
Tag operationscovers~ALLexcepthosted/**and blockscreationandupdate. The two Hosted rulesets coverhosted/**withcreation, and withupdateanddeletion. The bot getscurrent_user_can_bypass: neveron all three.security-ci.mdrequires ("Tag operations must target~ALLtags exceptrefs/tags/hosted/**").tagin.github/workflows/hosted-production.ymlis the only job that useshosted-release-tag, and itneeds: deploy, which runs in the review-gatedhosted-productionenvironment. The spec also sayshosted-release-tagrequires no review.Nothing in this repo clears the check without weakening a rule that
security-ci.mdaudits. The workable route is a tend change that combines tag rulesets and followsneedsinto a gated environment. Filing it needs a maintainer's go-ahead atmax-sixty/tend. Until then, these two FAILs are expected on every sweep.