tend check: configuration drift on PRQL/prql

[prql-bot]

uvx tend@latest check reports one failing check on this repo. It needs repo-admin access, which the bot does not have.

• repo-secret-allowlist — TEND_BOT_TOKEN is still repository-level, so it is readable by any workflow in the repo, including ones a PR can reach. It already exists in the tend environment (which admits only main) and in release; deleting the repository-level copy resolves this. DOCKERHUB_TOKEN / DOCKERHUB_USERNAME are already allowlisted in .config/tend.yaml and are not part of this.

Resolved since the last refresh: credential-environments now passes. github-pages and release both have a required reviewer, and the OIDC publish jobs were moved into the release environment by #6167 and #6170, so no job requests id-token: write outside an environment any more.

Evidence

FAIL  repo-secret-allowlist — Unexpected secrets (repo-level: TEND_BOT_TOKEN). These are available to all workflows, including those triggered by PRs. Move release secrets to a protected environment. If intentionally available, add to secrets.allowed in .config/tend.yaml. See docs/security-model.md.

Current state (via API):

Scope	Secrets	Protection
repo	DOCKERHUB_TOKEN, DOCKERHUB_USERNAME, TEND_BOT_TOKEN	—
env tend	CLAUDE_CODE_OAUTH_TOKEN, TEND_BOT_TOKEN	branch main only, no reviewers
env release	SNAPCRAFT_STORE_CREDENTIALS, TEND_BOT_TOKEN	tag *.*.*, 1 required reviewer
env github-pages	none	no branch policy, 1 required reviewer
env copilot	none	no policy, no reviewers

Passing checks: branch-protection:main, bot-permission, environment, environment-deployments, credential-environments, secrets, claude-auth.

See tend's security model.

Last refreshed: 2026-08-09

[prql-bot]

Triaged. These are admin-side settings changes rather than code, but the three checks aren't equally actionable — I traced every reference to both secrets, and only one of them can actually be moved as-is.

CLAUDE_CODE_OAUTH_TOKEN — safe to move now. All eight workflows that reference it are tend-*, and every referencing job declares environment: tend. Moving it from repo level into the tend environment clears claude-auth and half of repo-secret-allowlist with no workflow edits.

TEND_BOT_TOKEN — moving it as-is would break the release pipeline. Five jobs outside environment: tend use it:

Job	Trigger	Can it take environment: tend?
release.yaml brew-dispatcher	if: github.event_name == 'release'	No — ref is a tag, tend admits main only
release.yaml publish-winget	if: github.event_name == 'release'	No — same
release.yaml push-web-branch	if: github.event_name == 'release'	No — same
pull-request-target.yaml backport	pull_request_target	Yes — runs on the base ref; tend-review.yaml already pairs pull_request_target with environment: tend
tests.yaml update-rust-toolchain	nightly-upstream = schedule on prql	Yes — scheduled runs use main

So the full path is: add environment: tend to the last two jobs, and give the three release jobs a home for the token — either a copy in the release environment (which admits *.*.*) plus environment: release on them, or keep TEND_BOT_TOKEN repo-level and record it under secrets.allowed in .config/tend.yaml as a deliberate exception, the way DOCKERHUB_* already is. The second is the smaller change but keeps a bot PAT readable by every workflow, so it's a real tradeoff rather than a rubber stamp. I've left the workflow edits alone — a wrong deployment-branch policy on release.yaml only surfaces during an actual release, so it's worth doing together with the secret move rather than ahead of it. Happy to open that PR on request.

secret-environments is not a stale finding. I confirmed via the API that both tag rulesets (Auto-imported tag create protections, Auto-imported tag delete protections) are active over ~ALL with creation/update rules, but bypass_actors reads back as null under the bot's token — so the check genuinely cannot verify the bypass list is admin-only, rather than having missed the ruleset. Adding a required reviewer to release who isn't prql-bot is the check-visible fix.

Evidence

Verified against b787ce2 — grep -rn "TEND_BOT_TOKEN\|CLAUDE_CODE_OAUTH_TOKEN" .github/ cross-referenced with the environment: declaration on each enclosing job.

CLAUDE_CODE_OAUTH_TOKEN references, all inside jobs with environment: tend: tend-nightly (nightly), tend-review (review), tend-review-runs (review-runs), tend-mention (handle, L337), tend-notifications (notifications), tend-ci-fix (fix-ci), tend-triage (triage), tend-weekly (weekly).

TEND_BOT_TOKEN references inside environment: tend jobs: the same eight, plus tend-mention's verify job (L92–L330, environment: tend at L108). The five outside are in the table above.

Environment policies read back as:

tend    -> branch  main
release -> tag     *.*.*

Both have protection_rules: ["branch_policy"] only — no required reviewers on either.

Rulesets:

1640719  Auto-imported tag create protections  tag  active  rules=[creation, update]  conditions=~ALL  bypass_actors=null
1640721  Auto-imported tag delete protections  tag  active  rules=[update, deletion]   conditions=~ALL  bypass_actors=null

Prior instance of this drift report: #5907 (closed 2026-05-16, different failing checks).

[prql-bot]

Refreshed against uvx tend@latest check — the failure set changed since this issue was last updated.

Added: environment-deployments — all nine tend jobs name environment: tend without deployment: false, so GitHub files a deployment record per run and posts it on the PR. Unlike the other three, this needs no admin action; it clears when the generated tend-*.yaml files are refreshed, which tonight's tend/update-workflows regen does.

Changed: secret-environments is now credential-environments, and it found two things beyond the release tag-policy item already tracked here — the github-pages environment has no reviewers and no deployment branch policy (every ref reaches its secrets), and release.yaml's publish-js / publish-python jobs request id-token: write outside any environment, so nothing gates the ref the OIDC token is minted from.

Unchanged: claude-auth, repo-secret-allowlist. Body updated to match current state.

[prql-bot]

environment-deployments now passes — the nightly workflow regen in #6145 (tend 0.1.13 → 0.1.14) added deployment: false to every tend job, so GitHub no longer files a deployment record per run. The three remaining failures (credential-environments, claude-auth, repo-secret-allowlist) are unchanged and still need repo-admin access to fix. Body updated to match.

[prql-bot]

Refreshed against tonight's tend check. The failure set changed — down from three checks to two.

Resolved: claude-auth now passes. CLAUDE_CODE_OAUTH_TOKEN has been moved into the tend environment, so the harness token is now gated by the same branch policy as the rest of the tend jobs. That also shrank the repo-secret-allowlist finding, which previously named both CLAUDE_CODE_OAUTH_TOKEN and TEND_BOT_TOKEN and now names only TEND_BOT_TOKEN.

Still failing: repo-secret-allowlist (the repository-level TEND_BOT_TOKEN copy — it already exists in the tend environment, so the repo-level one can simply be deleted) and credential-environments (unchanged: github-pages, release, and the two un-environmented OIDC jobs in release.yaml). Body updated to match.

[prql-bot]

The failure set shrank — credential-environments now passes, so only repo-secret-allowlist remains. Body updated to match.

What changed: github-pages and release each have a required reviewer now, and #6167 / #6170 moved the OIDC publish jobs (publish-js, publish-python) into the release environment, so no job requests id-token: write outside an environment any more.

Remaining: deleting the repository-level TEND_BOT_TOKEN. It's already present in the tend and release environments, so removing the repo-level copy shouldn't break any workflow that reads it from an environment-gated job.

[prql-bot]

repo-secret-allowlist now passes — the repository-level TEND_BOT_TOKEN copy has been deleted, so the only repo-level secrets are the two allowlisted Docker Hub ones. #6169 moved every workflow that needs the PAT onto the tend (or release) environment, which was the last thing blocking the deletion.

Evidence

uvx tend@latest check on this run:

PASS  branch-protection:main — Branch 'main' is protected
PASS  bot-permission — Bot 'prql-bot' has 'write' permission
PASS  environment — Environment 'tend' admits only main
PASS  environment-deployments — No job files a deployment for the 'tend' environment
SKIP  credential-environments — Could not read the whole credential surface: tests.yaml is only reachable via `workflow_call` from outside this repo
PASS  secrets — Required secrets present: TEND_BOT_TOKEN
PASS  claude-auth — Claude auth secret present: CLAUDE_CODE_OAUTH_TOKEN
PASS  repo-secret-allowlist — All secrets available to workflows are in allowlist (could not check org-level — grant admin:org scope to verify)

Secret scopes via API:

Scope	Secrets
repo	DOCKERHUB_TOKEN, DOCKERHUB_USERNAME
env tend	CLAUDE_CODE_OAUTH_TOKEN, TEND_BOT_TOKEN
env release	SNAPCRAFT_STORE_CREDENTIALS, TEND_BOT_TOKEN
env github-pages	none

The remaining credential-environments line is a SKIP, not a FAIL: tests.yaml is callable via workflow_call, so tend can't prove the full credential surface from inside this repo. Nothing to fix here, so closing.