tend check: configuration drift on diffplug/dormouse

未关闭
  • 哪里不对？
#1,069 2 条评论 0 个 reaction 已指派 0 人 在 GitHub 查看

维护者通常 1 天内回复

还没有人认领这个 Issue。

评估

难度
5/5
预计耗时
一周以上
新手友好度
35/100
Issue 类型
缺陷
描述清晰度
描述清楚
活跃度
活跃
技术栈
github-actions, typescript
领域
ci-cd, security

调研方向

The reported behavior is in the upstream tend checker; this issue mentions .github/workflows/hosted-production.yml and docs/specs/security-ci.md as evidence for the repository’s setup. Start by reviewing tend’s tag-ruleset matching and credential-environment checks, then trace whether it follows workflow needs dependencies. Done means the checks recognize the split rulesets and gated workflow, without recommending a fix that conflicts with the documented App-bypass rule.

由索引模型根据 Issue 内容生成。

描述

tend check (tend 0.3.24, the pinned version) reports two FAILs on diffplug/dormouse. actions-event-policy is SKIP because the bot's token cannot read the Actions policies. Every other check passes.

  • tag-protection (FAIL): tend reports that the bot can create or repoint a tag and suggests tend check --fix to create an admin-gated all-tags ruleset.
  • credential-environments (FAIL): tend reports that blyg-publish, release-attest, and security-audit have no required reviewers and admit tags, with no all-tags ruleset restricting tags to admins that it could verify. It also reports that hosted-release-tag has no required reviewers and is reached by workflow_dispatch, so tend does not count its ref list as a gate.

These look like the check misreading this repository's layout, not real exposure. Tag protection is split across three rulesets, as docs/specs/security-ci.md requires. Tag operations covers ~ALL except refs/tags/hosted/** and blocks creation and update. Hosted tag creation and Hosted tag history cover refs/tags/hosted/**. The API reports current_user_can_bypass: never for the bot on all three. tend looks for a single all-tags ruleset, so it does not recognize the split. For hosted-release-tag, the only job using it (tag in .github/workflows/hosted-production.yml) needs: deploy, and deploy runs in hosted-production, which requires review from Ned or Edgar. A bot-fired dispatch therefore stops before the tag job. tend does not follow that needs chain.

Running tend check --fix as suggested would add an all-tags ruleset that also covers hosted/**. Unless the dormouse-hosted-tagger App were added as a bypass actor, that ruleset would block the App's tag creation. Adding the bypass would in turn break the security-ci.md rule that the App bypasses only Hosted tag creation. Two other ways to clear the FAILs: a tend change that unions tag rulesets and follows needs, or a required reviewer on hosted-release-tag, which the spec currently says requires no review. Filed upstream as max-sixty/tend#1637; #1526 warns against tend check --fix here. Until a tend release fixes it, these two FAILs are expected on every sweep.

Last refreshed: 2026-11-10

主要语言
TypeScript
星标
7
派生
1
平均合并
11 小时 37 分钟
30 天内合并 PR
463

环境准备

这个项目没有提供开发容器、Dockerfile 或贡献指南，环境需要你自己搭建：先看它的 README，通用步骤见我们的新手贡献指南。

从这里开始

  1. 先读完整个 Issue，再读项目的贡献指南。
  2. 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
  3. Fork 仓库，在一个分支上完成修改。
  4. 提交 Pull Request，并在描述里引用这个 Issue 编号。

diffplug/dormouse 的其他 Issue

查看 diffplug/dormouse 的全部 Issue

相似的 Issue

更多 TypeScript Issue

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。