tend check: configuration drift on PRQL/prql

[prql-bot]

tend check reports one failing check on PRQL/prql. It needs a repository admin to run tend check --fix; the bot cannot change the setting itself.

• immutable-releases — the newest release (0.13.14) can be rewritten, so its published assets can be replaced by anything holding write access, including this bot. GitHub applies immutability only to releases published after the setting is enabled, so once it is on, this check clears at the next release rather than retroactively.

Every other check passes: branch protection on main, bot permission, tag protection, the tend environment, environment deployment gating, credential-environment gating, required secrets, Claude auth, and the workflow secret allowlist.

Last refreshed: 2026-09-27

[prql-bot]

The one failing check needs a single repository setting, and the release pipeline is already shaped for it: #6332 moved every artifact upload into a draft that publish-release publishes once the uploads have landed, which is the flow GitHub recommends for publishing under immutability. So the setting can go on without any further workflow change.

Turning it on is admin-only in both directions — tend check --fix sends PUT /repos/PRQL/prql/immutable-releases, and the equivalent by hand is Settings → the "Releases" section → Enable release immutability. The bot's token gets a 404 on that endpoint on read as well as write, which is why the check falls back to the immutable flag on the newest release; 0.13.14 reports false. Since GitHub applies immutability only to releases published afterwards, the check clears when 0.13.15 goes out rather than when the toggle flips.

One thing worth knowing before enabling it: create-draft's "already published" annotation currently tells a maintainer to delete the release and re-run all jobs, and that recovery stops working once the setting is on. GitHub documents that a tag carrying an immutable release cannot be reused even after the release is deleted, so the re-run would fail to create the draft and the version would have to be re-cut. #6341 corrects that message and the comment above it — annotation text only, no change to any job or command.

What the check reads, and what it will read after the toggle

$ gh api -H "X-GitHub-Api-Version: 2026-03-10" repos/PRQL/prql/immutable-releases
{"message":"Not Found","status":"404"}

$ gh api repos/PRQL/prql/releases --jq '.[0:3][] | {tag: .tag_name, immutable}'
{"tag":"0.13.14","immutable":false}
{"tag":"0.13.13","immutable":false}
{"tag":"0.13.12","immutable":false}

A run holding admin reads the setting itself and clears immediately; the bot's run reads the newest release's flag, so it will keep failing until the first release published under the setting. The same lag runs the other way — if the setting were later turned off, the bot's run would not see it until the next release.

[prql-bot]

branch-protection:main has started failing since the last refresh — main now lets the bot create or delete the ref, which tend treats as the same lifecycle it protects against force-pushes. That in turn made the environment check unevaluable (SKIP): with no branch confirmed protected, tend can't determine which environments are admitted, so it will clear on its own once branch protection is restored.

immutable-releases is unchanged from the previous refresh. Both failures need a repository admin to run tend check --fix; the bot can't change either setting itself. Body updated to the current state.

[prql-bot]

Correction to my comment above: the new branch-protection:main failure is a stricter check, not a change to this repo's settings.

The sweep runs uvx tend@latest check, and tend moved 0.2.15 → 0.3.1 between last night and tonight. max-sixty/tend#1382 widened that check from the update rule alone to the full ref lifecycle, adding creation and deletion; the ruleset on main has always restricted update only, so it was passing under the narrower check and fails under the wider one. tend check --fix adds the two missing rules. The environment SKIP follows from it as described.

Body updated to say so.

[prql-bot]

branch-protection:main now passes — the ruleset on main restricts creation and deletion as well as update — and environment is evaluated again and passes. immutable-releases is the only remaining failure.