Skip to content

ci: Try warden #317

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
lcian wants to merge 2 commits into from
Closed

ci: Try warden #317

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
d1aaaf4
ci: Try warden
lcian Feb 18, 2026
62ab3ad
ci(warden): Use GitHub App token, configure review skills
lcian Feb 18, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
27 changes: 27 additions & 0 deletions .github/workflows/warden.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,27 @@
name: Warden

permissions:
contents: read

on:
pull_request:
types: [opened, synchronize, reopened]

jobs:
review:
runs-on: ubuntu-latest
env:
WARDEN_ANTHROPIC_API_KEY: ${{ secrets.WARDEN_ANTHROPIC_API_KEY }}
WARDEN_MODEL: ${{ secrets.WARDEN_MODEL }}
steps:
- uses: actions/checkout@v4

- uses: actions/create-github-app-token@v1
id: app-token
with:
app-id: ${{ secrets.WARDEN_APP_ID }}
private-key: ${{ secrets.WARDEN_PRIVATE_KEY }}

- uses: getsentry/warden@v0
with:
Comment on lines +17 to +26

@github-actions github-actions Bot Feb 18, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟠 [EZE-BEU] GitHub Actions not pinned to commit hashes (medium confidence)

Actions use version tags (@v4, @v0) instead of commit hashes. Version tags can be moved to point to different commits, potentially allowing supply chain attacks if the action repository is compromised.

Suggested fix: Pin actions to specific commit hashes for better supply chain security. Look up the current commit for each version tag and use that hash.

Suggested change
- uses: actions/checkout@v4
- uses: getsentry/warden@v0
with:
- uses: actions/checkout@<COMMIT_HASH> # v4
- uses: getsentry/warden@<COMMIT_HASH> # v0

Identified by Warden via security-review · medium, medium confidence

github-token: ${{ steps.app-token.outputs.token }}
43 changes: 43 additions & 0 deletions warden.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,43 @@
# Warden Configuration
# https://github.com/getsentry/warden

version = 1

[defaults]
failOn = "critical"
reportOn = "medium"

# Find bugs and vulnerabilities in code changes
[[skills]]
name = "find-bugs"
remote = "getsentry/skills"

[[skills.triggers]]
type = "pull_request"
actions = ["opened", "synchronize", "reopened"]

# Security review following OWASP guidelines
[[skills]]
name = "security-review"
remote = "getsentry/skills"

[[skills.triggers]]
type = "pull_request"
actions = ["opened", "synchronize", "reopened"]

# Code review following Sentry engineering practices
[[skills]]
name = "code-review"
remote = "getsentry/skills"

[[skills.triggers]]
type = "pull_request"
actions = ["opened", "synchronize", "reopened"]

# Simplify and refine code for clarity and maintainability
[[skills]]
name = "code-simplifier"
remote = "getsentry/skills"

[[skills.triggers]]
type = "local"
Loading