From d1aaaf4c930375b03cffecb5e593ab0b2dbcb21f Mon Sep 17 00:00:00 2001
From: lcian <17258265+lcian@users.noreply.github.com>
Date: Wed, 18 Feb 2026 15:52:46 +0100
Subject: [PATCH 1/2] ci: Try warden

---
 .github/workflows/warden.yml | 24 ++++++++++++++++++++
 warden.toml                  | 43 ++++++++++++++++++++++++++++++++++++
 2 files changed, 67 insertions(+)
 create mode 100644 .github/workflows/warden.yml
 create mode 100644 warden.toml

diff --git a/.github/workflows/warden.yml b/.github/workflows/warden.yml
new file mode 100644
index 00000000..f2ff0532
--- /dev/null
+++ b/.github/workflows/warden.yml
@@ -0,0 +1,24 @@
+name: Warden
+
+on:
+  pull_request:
+    types: [opened, synchronize, reopened]
+
+# contents: write required for resolving review threads via GraphQL
+# See: https://github.com/orgs/community/discussions/44650
+permissions:
+  contents: write
+  pull-requests: write
+  checks: write
+
+jobs:
+  review:
+    runs-on: ubuntu-latest
+    env:
+      WARDEN_MODEL: ${{ secrets.WARDEN_MODEL }}
+      WARDEN_SENTRY_DSN: ${{ secrets.WARDEN_SENTRY_DSN }}
+    steps:
+      - uses: actions/checkout@v4
+      - uses: getsentry/warden@v0
+        with:
+          anthropic-api-key: ${{ secrets.WARDEN_ANTHROPIC_API_KEY }}
diff --git a/warden.toml b/warden.toml
new file mode 100644
index 00000000..4a501e56
--- /dev/null
+++ b/warden.toml
@@ -0,0 +1,43 @@
+# Warden Configuration
+# https://github.com/getsentry/warden
+
+version = 1
+
+[defaults]
+failOn = "critical"
+reportOn = "medium"
+
+# Find bugs and vulnerabilities in code changes
+[[skills]]
+name = "find-bugs"
+remote = "getsentry/skills"
+
+[[skills.triggers]]
+type = "pull_request"
+actions = ["opened", "synchronize", "reopened"]
+
+# Security review following OWASP guidelines
+[[skills]]
+name = "security-review"
+remote = "getsentry/skills"
+
+[[skills.triggers]]
+type = "pull_request"
+actions = ["opened", "synchronize", "reopened"]
+
+# Code review following Sentry engineering practices
+[[skills]]
+name = "code-review"
+remote = "getsentry/skills"
+
+[[skills.triggers]]
+type = "pull_request"
+actions = ["opened", "synchronize", "reopened"]
+
+# Simplify and refine code for clarity and maintainability
+[[skills]]
+name = "code-simplifier"
+remote = "getsentry/skills"
+
+[[skills.triggers]]
+type = "local"

From 62ab3adfa3c8e52fd3d65de8ee3d54a8df48da91 Mon Sep 17 00:00:00 2001
From: lcian <17258265+lcian@users.noreply.github.com>
Date: Wed, 18 Feb 2026 15:56:06 +0100
Subject: [PATCH 2/2] ci(warden): Use GitHub App token, configure review skills

- Switch from default GITHUB_TOKEN to dedicated GitHub App token
- Narrow permissions to contents: read
- Add find-bugs, security-review, code-review, and code-simplifier skills
- Remove WARDEN_SENTRY_DSN
---
 .github/workflows/warden.yml | 21 ++++++++++++---------
 1 file changed, 12 insertions(+), 9 deletions(-)

diff --git a/.github/workflows/warden.yml b/.github/workflows/warden.yml
index f2ff0532..b4dd2b42 100644
--- a/.github/workflows/warden.yml
+++ b/.github/workflows/warden.yml
@@ -1,24 +1,27 @@
 name: Warden
 
+permissions:
+  contents: read
+
 on:
   pull_request:
     types: [opened, synchronize, reopened]
 
-# contents: write required for resolving review threads via GraphQL
-# See: https://github.com/orgs/community/discussions/44650
-permissions:
-  contents: write
-  pull-requests: write
-  checks: write
-
 jobs:
   review:
     runs-on: ubuntu-latest
     env:
+      WARDEN_ANTHROPIC_API_KEY: ${{ secrets.WARDEN_ANTHROPIC_API_KEY }}
       WARDEN_MODEL: ${{ secrets.WARDEN_MODEL }}
-      WARDEN_SENTRY_DSN: ${{ secrets.WARDEN_SENTRY_DSN }}
     steps:
       - uses: actions/checkout@v4
+
+      - uses: actions/create-github-app-token@v1
+        id: app-token
+        with:
+          app-id: ${{ secrets.WARDEN_APP_ID }}
+          private-key: ${{ secrets.WARDEN_PRIVATE_KEY }}
+
       - uses: getsentry/warden@v0
         with:
-          anthropic-api-key: ${{ secrets.WARDEN_ANTHROPIC_API_KEY }}
+          github-token: ${{ steps.app-token.outputs.token }}