Repository navigation
tend check: configuration drift on diffplug/dormouse #1069
Description
Activity
Both FAILs trace to yesterday's intended change to how Hosted tags are minted, not to drift. eb1129e moved Hosted tagging to the
dormouse-hosted-taggerApp, and the rulesets were reshaped to match:Hosted tag creationandHosted tag historywere created, andTag operationswas updated to excluderefs/tags/hosted/**. All three changes landed between 2026-10-07T20:28:32Z and 20:28:45Z. Once that exclusion landed, no single ruleset covered every tag. That is the shape tend'stag-protectionlooks for, andcredential-environmentsfails because it builds on that check for thev*-admitting environments.I checked the body's claims against the live repo and they hold:
Tag operationscovers~ALLexcepthosted/**and blockscreationandupdate. The two Hosted rulesets coverhosted/**withcreation, and withupdateanddeletion. The bot getscurrent_user_can_bypass: neveron all three.- That split is what
security-ci.mdrequires ("Tag operations must target~ALLtags exceptrefs/tags/hosted/**"). tagin.github/workflows/hosted-production.ymlis the only job that useshosted-release-tag, and itneeds: deploy, which runs in the review-gatedhosted-productionenvironment. The spec also sayshosted-release-tagrequires no review.
Nothing in this repo clears the check without weakening a rule that
security-ci.mdaudits. The workable route is a tend change that combines tag rulesets and followsneedsinto a gated environment. Filing it needs a maintainer's go-ahead atmax-sixty/tend. Until then, these two FAILs are expected on every sweep.
tend check(tend 0.3.10, the pinned version) reports two FAILs ondiffplug/dormouse.actions-event-policyis SKIP because the bot's token cannot read the Actions policies. Every other check passes.tag-protection(FAIL): tend reports that the bot can create or repoint a tag and suggeststend check --fixto create an admin-gated all-tags ruleset.credential-environments(FAIL): tend reports thatblyg-publish,release-attest, andsecurity-audithave no required reviewers and admit tags, with no all-tags ruleset restricting tags to admins that it could verify. It also reports thathosted-release-taghas no required reviewers and is reached byworkflow_dispatch, so tend does not count its ref list as a gate.These look like the check misreading this repository's layout, not real exposure. Tag protection is split across three rulesets, as
docs/specs/security-ci.mdrequires.Tag operationscovers~ALLexceptrefs/tags/hosted/**and blockscreationandupdate.Hosted tag creationandHosted tag historycoverrefs/tags/hosted/**. The API reportscurrent_user_can_bypass: neverfor the bot on all three. tend looks for a single all-tags ruleset, so it does not recognize the split. Forhosted-release-tag, the only job using it (tagin.github/workflows/hosted-production.yml)needs: deploy, anddeployruns inhosted-production, which requires review from Ned or Edgar. A bot-fired dispatch therefore stops before the tag job. tend does not follow thatneedschain.Running
tend check --fixas suggested would add an all-tags ruleset that also covershosted/**. Unless thedormouse-hosted-taggerApp were added as a bypass actor, that ruleset would block the App's tag creation. Adding the bypass would in turn break thesecurity-ci.mdrule that the App bypasses onlyHosted tag creation. Two other ways to clear the FAILs: a tend change that unions tag rulesets and followsneeds, or a required reviewer onhosted-release-tag, which the spec currently says requires no review. Filing upstream atmax-sixty/tendneeds a maintainer's go-ahead.Last refreshed: 2026-10-10