tend check: configuration drift on diffplug/dormouse

[dormouse-bot]

tend check (tend 0.3.2) reports one FAIL on diffplug/dormouse. Every other check passes.

• immutable-releases (FAIL): the newest release, v1.1.0 (published 2026-07-16), reports "immutable": false, so its assets can still be replaced.

This is probably not new drift. In #701, an admin reported enabling immutable releases. GitHub applies that setting only to releases published after it is turned on, so v1.1.0 stays mutable no matter what. tend 0.3.1 has no immutable-releases line in its output, so this check appeared with the move to the 0.3.2 pin. The check should clear by itself at the next release. The only admin action worth taking is to confirm the repository setting is still on (Settings → General → "Immutable releases"). A non-admin token cannot read that setting.

Last refreshed: 2026-09-28

[dormouse-bot]

The admin-side question in the body is already answered: @nedtwigg reported enabling immutable releases on 2026-09-23 in #701, and nothing here needs changing before the next release. v1.1.0 (2026-07-16) predates the setting and stays mutable permanently, so this FAIL is expected to clear when the next release publishes with "immutable": true. That release is also the first point where a non-admin token can confirm the setting.

One correction to the body: tend 0.3.1 did run immutable-releases. #701's body lists it as a FAIL under 0.3.1, and after the setting was enabled, the admin reported all ten 0.3.1 checks passing. So the check did not first appear with 0.3.2. What changed is how it passes. The admin's passing run could read the setting directly, while this sweep's non-admin token can only read the newest release's immutable flag. I haven't confirmed which of those accounts for the 0.3.2 result.

Both release-side follow-ups from #701 are settled. #766 (merged) makes scripts/sign-and-deploy.sh refuse to re-upload assets to a published release, and #761 (merged) updated the Merge access rule. The docs/specs/security-ci.md row that #701 proposed for the setting itself has not been added; that spec does not mention immutable releases yet.