tend check: configuration drift on diffplug/dormouse

Abierto
  • ¿Algo no está bien?
#1,069 2 comentarios 0 reacciones 0 asignados Ver en GitHub

Los mantenedores suelen responder en 1 día

Nadie ha tomado este issue todavía.

Evaluación

Dificultad
5/5
Tiempo estimado
Más de una semana
Aptitud para principiantes
35/100
Tipo de issue
Error
Claridad
Bien especificado
Estado de actividad
Activo
Stack tecnológico
github-actions, typescript
Área
ci-cd, security

Línea de trabajo

The reported behavior is in the upstream tend checker; this issue mentions .github/workflows/hosted-production.yml and docs/specs/security-ci.md as evidence for the repository’s setup. Start by reviewing tend’s tag-ruleset matching and credential-environment checks, then trace whether it follows workflow needs dependencies. Done means the checks recognize the split rulesets and gated workflow, without recommending a fix that conflicts with the documented App-bypass rule.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

tend check (tend 0.3.24, the pinned version) reports two FAILs on diffplug/dormouse. actions-event-policy is SKIP because the bot's token cannot read the Actions policies. Every other check passes.

  • tag-protection (FAIL): tend reports that the bot can create or repoint a tag and suggests tend check --fix to create an admin-gated all-tags ruleset.
  • credential-environments (FAIL): tend reports that blyg-publish, release-attest, and security-audit have no required reviewers and admit tags, with no all-tags ruleset restricting tags to admins that it could verify. It also reports that hosted-release-tag has no required reviewers and is reached by workflow_dispatch, so tend does not count its ref list as a gate.

These look like the check misreading this repository's layout, not real exposure. Tag protection is split across three rulesets, as docs/specs/security-ci.md requires. Tag operations covers ~ALL except refs/tags/hosted/** and blocks creation and update. Hosted tag creation and Hosted tag history cover refs/tags/hosted/**. The API reports current_user_can_bypass: never for the bot on all three. tend looks for a single all-tags ruleset, so it does not recognize the split. For hosted-release-tag, the only job using it (tag in .github/workflows/hosted-production.yml) needs: deploy, and deploy runs in hosted-production, which requires review from Ned or Edgar. A bot-fired dispatch therefore stops before the tag job. tend does not follow that needs chain.

Running tend check --fix as suggested would add an all-tags ruleset that also covers hosted/**. Unless the dormouse-hosted-tagger App were added as a bypass actor, that ruleset would block the App's tag creation. Adding the bypass would in turn break the security-ci.md rule that the App bypasses only Hosted tag creation. Two other ways to clear the FAILs: a tend change that unions tag rulesets and follows needs, or a required reviewer on hosted-release-tag, which the spec currently says requires no review. Filed upstream as max-sixty/tend#1637; #1526 warns against tend check --fix here. Until a tend release fixes it, these two FAILs are expected on every sweep.

Last refreshed: 2026-11-10

Lenguaje dominante
TypeScript
Estrellas
7
Forks
1
Merge medio
11 h 37 min
PR fusionados (30 d)
463

Preparar el entorno

Este proyecto no incluye contenedor de desarrollo, Dockerfile ni guía de contribución, así que la configuración corre por tu cuenta: empieza por su README y consulta nuestra guía para la primera contribución para los pasos generales.

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de diffplug/dormouse

Todos los issues de diffplug/dormouse

Issues similares

Más issues de TypeScript

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.