Skip to content

docs(tend): the org-secret false positive is fixed upstream in 0.1.18 #381

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
dormouse-bot wants to merge 1 commit into
base: main
Choose a base branch
from
+3 −3
Open

docs(tend): the org-secret false positive is fixed upstream in 0.1.18 #381

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 3 additions & 3 deletions .claude/skills/running-tend/SKILL.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,15 +15,15 @@ After approving a visually-changing PR the approval is gated, so the CI Monitori

When `UI Tests` is the only non-terminal check and every automated check is green (Build & Test, Visual Regression Tests, verify, Standalone Smoketest, Cloudflare Pages, Storybook Publish), treat it as human-gated: stop polling, confirm nothing flipped to FAILURE, and keep the approval standing — don't wait out the poll cap. Polling it to the cap wastes ~9–17 job-minutes per visually-changing PR with no added signal. (Observed on #203, #289, #317.)

## `tend check`'s org-level `repo-secret-allowlist` FAIL is a known false positive
## The org-level `repo-secret-allowlist` FAIL was a false positive — fixed upstream in tend 0.1.18

`tend check` reports all ten `diffplug` org-level secrets (`BUILDCACHE_*`, `CHOCO_*`, `GPG_*`, `GRADLE_*`, `NEXUS_*`) as available to this repo's workflows. They are not. Every one has `visibility: selected`, and none of their selected-repositories lists includes `diffplug/dormouse` — verify with (org-admin only; the workflow token 403s on this endpoint, so take the ruling as given from CI):
Historical: `tend check` used to report all ten `diffplug` org-level secrets (`BUILDCACHE_*`, `CHOCO_*`, `GPG_*`, `GRADLE_*`, `NEXUS_*`) as available to this repo's workflows. They are not — every one has `visibility: selected`, and none of their selected-repositories lists includes `diffplug/dormouse`. The sweep enumerated org secrets without consulting visibility. Filed as [max-sixty/tend#993](https://github.com/max-sixty/tend/issues/993), fixed by [max-sixty/tend#994](https://github.com/max-sixty/tend/pull/994), and shipped in tend 0.1.18; the check reports PASS again. If it ever reappears, verify with (org-admin only; the workflow token 403s on this endpoint, so take the ruling as given from CI):

```
gh api orgs/diffplug/actions/secrets/NEXUS_USER/repositories --jq '.repositories[].full_name'
```

The sweep enumerates org secrets without consulting visibility, so no repo-side configuration can clear it — the secrets are already at the tightest scoping GitHub offers. Do **not** add them to `secrets.allowed` in `.config/tend.yaml`: that entry means "any workflow here can read this token," which is false, and it would suppress the warning if one of them were ever genuinely shared with this repo. Filed upstream as [max-sixty/tend#993](https://github.com/max-sixty/tend/issues/993); leave the FAIL standing until it's fixed, and don't report it as new drift on [#339](https://github.com/diffplug/dormouse/issues/339).
The durable ruling outlives the bug: do **not** add these names to `secrets.allowed` in `.config/tend.yaml`. That entry means "any workflow here can read this token," which is false — the secrets are already at the tightest scoping GitHub offers — and it would suppress the warning if one of them were ever genuinely shared with this repo.

## Settled upstream rulings — don't re-file

Expand Down