build(deps): bump getsentry/github-workflows from b6d9e26d1c5bb01362670e13288b2284bab8cbf9 to c802283cd9075b7a2b7a32655019c21c21676e34 #1298
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Warden | |
| on: | |
| pull_request: | |
| types: [opened, synchronize, reopened] | |
| jobs: | |
| check-permissions: | |
| runs-on: ubuntu-latest | |
| outputs: | |
| HAS_SECRETS: ${{ steps.check.outputs.HAS_SECRETS }} | |
| steps: | |
| - run: echo "HAS_SECRETS=${{ secrets.WARDEN_PRIVATE_KEY != '' }}" >> "$GITHUB_OUTPUT" | |
| id: check | |
| warden: | |
| runs-on: ubuntu-latest | |
| needs: check-permissions | |
| if: ${{ needs.check-permissions.outputs.HAS_SECRETS == 'true' }} | |
| permissions: | |
| contents: read | |
| id-token: write | |
| env: | |
| WARDEN_ANTHROPIC_API_KEY: ${{ secrets.WARDEN_ANTHROPIC_API_KEY }} | |
| WARDEN_MODEL: ${{ secrets.WARDEN_MODEL }} | |
| WARDEN_SENTRY_DSN: ${{ secrets.WARDEN_SENTRY_DSN }} | |
| steps: | |
| - name: Checkout Code | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| - name: Checkout Org GitHub Repo | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| with: | |
| repository: ${{ github.repository_owner }}/.github | |
| path: .warden-org | |
| - uses: actions/create-github-app-token@29824e69f54612133e76f7eaac726eef6c875baf # v2.2.1 | |
| id: app-token | |
| with: | |
| app-id: ${{ secrets.WARDEN_APP_ID }} | |
| private-key: ${{ secrets.WARDEN_PRIVATE_KEY }} | |
| owner: ${{ github.repository_owner }} # access to all repos, cause this is triggered on org level | |
| - uses: getsentry/warden@v0 | |
| id: warden | |
| continue-on-error: true # throw no error for now | |
| with: | |
| github-token: ${{ steps.app-token.outputs.token }} | |
| base-config-path: .warden-org/warden.toml | |
| - name: Authenticate to Google Cloud | |
| continue-on-error: true | |
| uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 | |
| with: | |
| workload_identity_provider: projects/868781662168/locations/global/workloadIdentityPools/prod-github/providers/github-oidc-pool | |
| service_account: gha-warden@sac-prod-sa.iam.gserviceaccount.com | |
| - name: Rename findings file with timestamp | |
| id: rename-findings | |
| if: always() && steps.warden.outputs.findings-file != '' | |
| env: | |
| FINDINGS_FILE: ${{ steps.warden.outputs.findings-file }} | |
| run: | | |
| DEST="$RUNNER_TEMP/$(date -u +%Y-%m-%dT%H%M%SZ).json" | |
| cp "$FINDINGS_FILE" "$DEST" | |
| echo "path=$DEST" >> "$GITHUB_OUTPUT" | |
| - name: Upload findings to GCS | |
| continue-on-error: true | |
| uses: google-github-actions/upload-cloud-storage@c0f6160ff80057923ff50e5e567695cea181ec23 # v2 | |
| if: always() && steps.rename-findings.outputs.path != '' | |
| with: | |
| path: ${{ steps.rename-findings.outputs.path }} | |
| destination: warden-logs/${{ github.repository }} |