tend check: configuration drift on max-sixty/cargo-affected

[cargo-affected-bot]

uvx tend@latest check reports one failing check on max-sixty/cargo-affected.

• credential-environments — the release environment has no required reviewers and admits tags, and no active all-tags ruleset restricting tag creation and update to admins could be verified, so a run the bot can cause reaches that environment's credentials. Gate it with a required reviewer that is not the bot, or a deployment policy naming only verified refs (protected branches, or tags under an admin-only all-tags ruleset). This is a repo-settings change: Settings → Environments → release.

Full tend check output

  PASS  branch-protection:main — Branch 'main' is protected
  PASS  bot-permission — Bot 'cargo-affected-bot' has 'write' permission
  PASS  environment — Environment 'tend' admits only main
  PASS  environment-deployments — No job files a deployment for the 'tend' environment
  FAIL  credential-environments — A run the bot can cause reaches a credential: 'release' has no required reviewers, and admits tags, and no active all-tags ruleset restricting creation and update to admins could be verified. Gate each environment with a required reviewer that is not the bot, or a deployment policy naming only verified refs (protected branches, or tags under an admin-only all-tags ruleset); move an OIDC job into such an environment.
  PASS  secrets — Required secrets present: TEND_BOT_TOKEN
  PASS  claude-auth — Claude auth secret present: CLAUDE_CODE_OAUTH_TOKEN
  PASS  repo-secret-allowlist — All secrets available to workflows are in allowlist

See tend's security model.

Last refreshed: 2026-08-12

[cargo-affected-bot]

The failure set changed since the last refresh — body updated to match.

Added: claude-auth — the tend environment holds no CLAUDE_CODE_OAUTH_TOKEN / ANTHROPIC_API_KEY. The token is present at repo level only, which is why the tend jobs still authenticate; it's a hardening gap, not an outage.

Changed: repo-secret-allowlist previously flagged only BOT_TOKEN. It now also flags CLAUDE_CODE_OAUTH_TOKEN and TEND_BOT_TOKEN, both of which are duplicated at repo level (tend already carries its own TEND_BOT_TOKEN).

Both failures collapse to one fix: move CLAUDE_CODE_OAUTH_TOKEN into the tend environment and delete the three repo-level copies. Commands are in the issue body.

[cargo-affected-bot]

The failure set changed since the last refresh — body updated to match.

Removed from repo-secret-allowlist: BOT_TOKEN and the repo-level TEND_BOT_TOKEN are both gone; the check now flags only CLAUDE_CODE_OAUTH_TOKEN. The tend environment carries its own TEND_BOT_TOKEN, so the bot-token half of this issue is fully resolved.

Unchanged: claude-auth still fails — CLAUDE_CODE_OAUTH_TOKEN exists at repo level only, not in the gated tend environment.

One fix closes both remaining lines: gh secret set CLAUDE_CODE_OAUTH_TOKEN --env tend followed by gh secret delete CLAUDE_CODE_OAUTH_TOKEN.

[cargo-affected-bot]

Refreshed against tonight's tend check. The failure set grew from two checks to four — the body above now reflects the current state.

Added since the last refresh:

• environment-deployments — all nine tend jobs name the tend environment without deployment: false. Expected to clear on its own once the nightly workflow-regeneration PR lands, since uvx tend@latest init emits the flag.
• credential-environments — the release environment has neither required reviewers nor a deployment branch policy, so any ref can reach its secrets.

Unchanged: claude-auth and repo-secret-allowlist, both still waiting on the CLAUDE_CODE_OAUTH_TOKEN move from repo level into the tend environment.

[cargo-affected-bot]

Two of the four failures cleared since the last refresh. claude-auth and repo-secret-allowlist both pass now that CLAUDE_CODE_OAUTH_TOKEN sits in the tend environment instead of at repo level.

The two that remain are unchanged: environment-deployments, whose fix is in flight as #79, and credential-environments, which needs a required reviewer or a deployment branch policy on the release environment. Body updated to match.

[cargo-affected-bot]

The failure set shrank from two to one. environment-deployments now passes: #79 landed the 0.1.14 regeneration, so every tend job carries deployment: false and no deployment records are filed against the tend environment.

credential-environments still fails, and its wording has sharpened — the check now names why the release environment is reachable: it admits tags, and no active all-tags ruleset restricting tag creation and update to admins could be verified. The remedy is unchanged and still a repo-settings change (Settings → Environments → release): a required reviewer that is not the bot, or a deployment policy naming only verified refs.

Body updated to match.