tend check: configuration drift on diffplug/dormouse

Open
#701 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
2/5
Estimated time
1-3 hours
Newbie friendliness
45/100
Issue type
Bug
Clarity
Clearly specified
Activity status
Active
Tech stack
github, github-actions

Research direction

Start with tend check and the immutable-releases result, then review .github/workflows/release.yml and docs/specs/security-ci.md. An administrator must enable immutable releases; done means the setting is enabled for future releases, the check is expected to clear at the next release, and the security specification mentions the guarantee.

Written by the indexing model from the issue text.

Description

tend check reports one FAIL on diffplug/dormouse. It needs repository-admin access, which the CI bot does not hold.

  • immutable-releases (FAIL): the newest release (v1.1.0) can be rewritten — a write-access account or bot can replace its assets. gh api repos/diffplug/dormouse --jq .immutable_releases returns null, so the setting has never been enabled. Fix is tend check --fix run by an admin (or Settings → General → "Immutable releases"). GitHub applies the setting only to releases published after it is enabled, so enabling it clears this check at the next release rather than retroactively for v1.1.0.

Every other check passes: branch-protection:main, bot-permission, tag-protection, environment, environment-deployments, credential-environments, secrets, claude-auth, repo-secret-allowlist. The credential-environments FAIL tracked in #339 is cleared.

Why this is not already covered by the release pipeline

.github/workflows/release.yml attests build provenance for the standalone and VS Code artifacts, which lets a consumer detect a substituted asset. Immutable releases is the complementary control: it stops the substitution at the API, so the attestation is not the only thing standing between a compromised write-access token and a rewritten v1.1.0 download. Tag rewriting is already blocked by the Tag operations ruleset (creation + update across ~ALL, bot bypass never); release assets are the remaining mutable surface on a published release.

docs/specs/security-ci.md does not currently mention the setting. Worth adding a row there once it is enabled, so the guarantee is stated where the audit reads it.

Last refreshed: 2026-09-21

Dominant language
TypeScript
Stars
5
Forks
1
Avg merge
18h 26m
Merged PRs (30d)
229

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from diffplug/dormouse

All issues in diffplug/dormouse

Similar issues

More TypeScript issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.