tend check: configuration drift on diffplug/dormouse

Offen
  • Stimmt etwas nicht?
#1,069 2 Kommentare 0 Reaktionen 0 zugewiesene Personen Auf GitHub ansehen

Maintainer antworten meist innerhalb von 1 Tag

Dieses Issue hat noch niemand übernommen.

Bewertung

Schwierigkeit
5/5
Geschätzter Aufwand
Über eine Woche
Anfängerfreundlichkeit
35/100
Issue-Typ
Bug
Klarheit
Klar beschrieben
Aktivitätsstatus
Aktiv
Tech-Stack
github-actions, typescript
Bereich
ci-cd, security

Rechercherichtung

The reported behavior is in the upstream tend checker; this issue mentions .github/workflows/hosted-production.yml and docs/specs/security-ci.md as evidence for the repository’s setup. Start by reviewing tend’s tag-ruleset matching and credential-environment checks, then trace whether it follows workflow needs dependencies. Done means the checks recognize the split rulesets and gated workflow, without recommending a fix that conflicts with the documented App-bypass rule.

Vom Indexierungsmodell aus dem Issue-Text verfasst.

Beschreibung

tend check (tend 0.3.24, the pinned version) reports two FAILs on diffplug/dormouse. actions-event-policy is SKIP because the bot's token cannot read the Actions policies. Every other check passes.

  • tag-protection (FAIL): tend reports that the bot can create or repoint a tag and suggests tend check --fix to create an admin-gated all-tags ruleset.
  • credential-environments (FAIL): tend reports that blyg-publish, release-attest, and security-audit have no required reviewers and admit tags, with no all-tags ruleset restricting tags to admins that it could verify. It also reports that hosted-release-tag has no required reviewers and is reached by workflow_dispatch, so tend does not count its ref list as a gate.

These look like the check misreading this repository's layout, not real exposure. Tag protection is split across three rulesets, as docs/specs/security-ci.md requires. Tag operations covers ~ALL except refs/tags/hosted/** and blocks creation and update. Hosted tag creation and Hosted tag history cover refs/tags/hosted/**. The API reports current_user_can_bypass: never for the bot on all three. tend looks for a single all-tags ruleset, so it does not recognize the split. For hosted-release-tag, the only job using it (tag in .github/workflows/hosted-production.yml) needs: deploy, and deploy runs in hosted-production, which requires review from Ned or Edgar. A bot-fired dispatch therefore stops before the tag job. tend does not follow that needs chain.

Running tend check --fix as suggested would add an all-tags ruleset that also covers hosted/**. Unless the dormouse-hosted-tagger App were added as a bypass actor, that ruleset would block the App's tag creation. Adding the bypass would in turn break the security-ci.md rule that the App bypasses only Hosted tag creation. Two other ways to clear the FAILs: a tend change that unions tag rulesets and follows needs, or a required reviewer on hosted-release-tag, which the spec currently says requires no review. Filed upstream as max-sixty/tend#1637; #1526 warns against tend check --fix here. Until a tend release fixes it, these two FAILs are expected on every sweep.

Last refreshed: 2026-11-10

Vorherrschende Sprache
TypeScript
Sterne
7
Forks
1
Ø Merge
11 Std. 37 Min.
Gemergte PRs (30 T.)
463

Entwicklungsumgebung

Dieses Projekt bietet weder Dev-Container noch Dockerfile noch Beitragsleitfaden – die Einrichtung liegt bei Ihnen. Beginnen Sie mit der README; die allgemeinen Schritte stehen in unserem Leitfaden für den ersten Beitrag.

Erste Schritte

  1. Lesen Sie das ganze Issue und danach den Beitragsleitfaden des Projekts.
  2. Schreiben Sie ins Issue, dass Sie es übernehmen — das erspart doppelte Arbeit.
  3. Forken Sie das Repository und arbeiten Sie in einem Branch.
  4. Öffnen Sie einen Pull Request, der die Issue-Nummer nennt.

Mehr aus diffplug/dormouse

Alle Issues in diffplug/dormouse

Ähnliche Issues

Weitere Issues zu TypeScript

Neue Issues direkt in Ihr Postfach

Eine kurze Übersicht über anfängerfreundliche GitHub-Issues.