tend check: configuration drift on diffplug/dormouse
Nobody has claimed this yet.
Assessment
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Newbie friendliness
- 45/100
- Issue type
- Bug
- Clarity
- Clearly specified
- Activity status
- Active
- Tech stack
- github, github-actions
- Domain
- devops, documentation, security
Research direction
Start with tend check and the immutable-releases result, then review .github/workflows/release.yml and docs/specs/security-ci.md. An administrator must enable immutable releases; done means the setting is enabled for future releases, the check is expected to clear at the next release, and the security specification mentions the guarantee.
Written by the indexing model from the issue text.
Description
tend check reports one FAIL on diffplug/dormouse. It needs repository-admin access, which the CI bot does not hold.
immutable-releases(FAIL): the newest release (v1.1.0) can be rewritten — a write-access account or bot can replace its assets.gh api repos/diffplug/dormouse --jq .immutable_releasesreturnsnull, so the setting has never been enabled. Fix istend check --fixrun by an admin (or Settings → General → "Immutable releases"). GitHub applies the setting only to releases published after it is enabled, so enabling it clears this check at the next release rather than retroactively forv1.1.0.
Every other check passes: branch-protection:main, bot-permission, tag-protection, environment, environment-deployments, credential-environments, secrets, claude-auth, repo-secret-allowlist. The credential-environments FAIL tracked in #339 is cleared.
Why this is not already covered by the release pipeline
.github/workflows/release.yml attests build provenance for the standalone and VS Code artifacts, which lets a consumer detect a substituted asset. Immutable releases is the complementary control: it stops the substitution at the API, so the attestation is not the only thing standing between a compromised write-access token and a rewritten v1.1.0 download. Tag rewriting is already blocked by the Tag operations ruleset (creation + update across ~ALL, bot bypass never); release assets are the remaining mutable surface on a published release.
docs/specs/security-ci.md does not currently mention the setting. Worth adding a row there once it is enabled, so the guarantee is stated where the audit reads it.
Last refreshed: 2026-09-21
- Dominant language
- TypeScript
- Stars
- 5
- Forks
- 1
- Avg merge
- 18h 26m
- Merged PRs (30d)
- 229
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from diffplug/dormouse
-
Difficulty 4/5 3-5 days Newbie friendliness 35/100
-
Difficulty 4/5 3-5 days Newbie friendliness 35/100
-
Difficulty 4/5 3-5 days Newbie friendliness 25/100
-
Difficulty 4/5 3-5 days Newbie friendliness 25/100
-
tend-review drops the verdict on every draft-to-ready PR: the sandbox has no $GITHUB_EVENT_PATH Open
Difficulty 3/5 1-2 days Newbie friendliness 72/100
All issues in diffplug/dormouse
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 84/100
copse-dev/agent-pane#2953 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 84/100
Eynzof/Hermes-CN-Desktop#610 ·
-
bug clawsweeper:linked-pr-open clawsweeper:needs-live-repro clawsweeper:no-new-fix-pr impact:message-loss issue-rating: 🐚 platinum hermit P2 regression
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
-
enhancement
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
-
calcite-components needs triage refactor
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
Esri/calcite-design-system#15203 ·