Repository navigation
fix(utils): look up package versions without scanning all installed packages #4359
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Warden | |
| # Update the concurrency group below if this workflow adds non-PR triggers. | |
| on: | |
| pull_request: | |
| types: [opened, synchronize, reopened] | |
| concurrency: | |
| group: ${{ github.workflow }}-pr-${{ github.event.pull_request.number }} | |
| cancel-in-progress: true | |
| jobs: | |
| warden: | |
| # Skip PRs opened by these apps. Only list apps whose PRs carry no human | |
| # changes, since Warden won't review any commit on them. | |
| # - materialized-ops-sync[bot]: mirrors manifests generated from | |
| # getsentry/ops PRs, which Warden already reviews there. | |
| if: >- | |
| github.event.pull_request.head.repo.full_name == github.repository && | |
| !contains(fromJSON('["materialized-ops-sync[bot]"]'), github.event.pull_request.user.login) | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| pull-requests: read | |
| id-token: write | |
| checks: read | |
| env: | |
| WARDEN_OPENROUTER_API_KEY: ${{ secrets.WARDEN_OPENROUTER_API_KEY }} | |
| WARDEN_MODEL: ${{ secrets.WARDEN_MODEL }} | |
| WARDEN_SENTRY_DSN: ${{ secrets.WARDEN_SENTRY_DSN }} | |
| WARDEN_SERVICE_URL: ${{ vars.WARDEN_SERVICE_URL }} | |
| WARDEN_SERVICE_TOKEN: ${{ secrets.WARDEN_SERVICE_TOKEN }} | |
| steps: | |
| - name: Check Warden credentials | |
| env: | |
| HAS_OPENROUTER_API_KEY: ${{ secrets.WARDEN_OPENROUTER_API_KEY != '' }} | |
| run: | | |
| if [[ "$HAS_OPENROUTER_API_KEY" == "true" ]]; then | |
| exit 0 | |
| fi | |
| MESSAGE="Warden cannot review this pull request because WARDEN_OPENROUTER_API_KEY is unavailable. Add it to the organization Actions secrets." | |
| echo "::error::$MESSAGE" | |
| printf '## Warden unavailable\n\n%s\n' "$MESSAGE" >> "$GITHUB_STEP_SUMMARY" | |
| exit 1 | |
| - name: Checkout Code | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - name: Checkout Org GitHub Repo | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| repository: ${{ github.repository_owner }}/.github | |
| path: .warden-org | |
| - name: Analyze | |
| id: warden-analyze | |
| uses: getsentry/warden@v0 | |
| with: | |
| mode: analyze | |
| base-config-path: .warden-org/warden.toml | |
| - uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0 | |
| id: app-token | |
| if: ${{ always() && steps.warden-analyze.outputs.findings-file != '' }} | |
| with: | |
| app-id: ${{ secrets.WARDEN_APP_ID }} | |
| private-key: ${{ secrets.WARDEN_PRIVATE_KEY }} | |
| owner: ${{ github.repository_owner }} # access to all repos, cause this is triggered on org level | |
| - name: Report | |
| if: ${{ always() && steps.warden-analyze.outputs.findings-file != '' && steps.app-token.outcome == 'success' }} | |
| uses: getsentry/warden@v0 | |
| with: | |
| mode: report | |
| findings-file: ${{ steps.warden-analyze.outputs.findings-file }} | |
| github-token: ${{ steps.app-token.outputs.token }} | |
| base-config-path: .warden-org/warden.toml | |
| - name: Authenticate to Google Cloud | |
| if: ${{ always() && steps.warden-analyze.outputs.findings-file != '' }} | |
| continue-on-error: true | |
| uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 | |
| with: | |
| workload_identity_provider: projects/868781662168/locations/global/workloadIdentityPools/prod-github/providers/github-oidc-pool | |
| service_account: gha-warden@sac-prod-sa.iam.gserviceaccount.com | |
| - name: Rename findings file with timestamp | |
| id: rename-findings | |
| if: ${{ always() && steps.warden-analyze.outputs.findings-file != '' }} | |
| env: | |
| FINDINGS_FILE: ${{ steps.warden-analyze.outputs.findings-file }} | |
| run: | | |
| DEST="$RUNNER_TEMP/$(date -u +%Y-%m-%dT%H%M%SZ).json" | |
| cp "$FINDINGS_FILE" "$DEST" | |
| echo "path=$DEST" >> "$GITHUB_OUTPUT" | |
| - name: Upload findings to GCS | |
| continue-on-error: true | |
| uses: google-github-actions/upload-cloud-storage@6397bd7208e18d13ba2619ee21b9873edc94427a # v3.0.0 | |
| if: ${{ always() && steps.rename-findings.outputs.path != '' }} | |
| with: | |
| path: ${{ steps.rename-findings.outputs.path }} | |
| destination: warden-logs/${{ github.repository }} | |
| process_gcloudignore: false |