Bump getsentry/github-workflows from 71588ddf95134f804e82c5970a8098588e2eaecd to c802283cd9075b7a2b7a32655019c21c21676e34 #11
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Warden | |
| on: | |
| pull_request: | |
| types: [opened, synchronize, reopened] | |
| jobs: | |
| check-permissions: | |
| runs-on: ubuntu-latest | |
| outputs: | |
| HAS_SECRETS: ${{ steps.check.outputs.HAS_SECRETS }} | |
| steps: | |
| - run: echo "HAS_SECRETS=${{ secrets.WARDEN_PRIVATE_KEY != '' }}" >> "$GITHUB_OUTPUT" | |
| id: check | |
| warden: | |
| runs-on: ubuntu-latest | |
| needs: check-permissions | |
| if: ${{ needs.check-permissions.outputs.HAS_SECRETS == 'true' }} | |
| permissions: | |
| contents: read | |
| id-token: write | |
| env: | |
| WARDEN_ANTHROPIC_API_KEY: ${{ secrets.WARDEN_ANTHROPIC_API_KEY }} | |
| WARDEN_MODEL: ${{ secrets.WARDEN_MODEL }} | |
| WARDEN_SENTRY_DSN: ${{ secrets.WARDEN_SENTRY_DSN }} | |
| steps: | |
| - name: Checkout Code | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| - name: Checkout Org GitHub Repo | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| with: | |
| repository: ${{ github.repository_owner }}/.github | |
| path: .warden-org | |
| - uses: actions/create-github-app-token@29824e69f54612133e76f7eaac726eef6c875baf # v2.2.1 | |
| id: app-token | |
| with: | |
| app-id: ${{ secrets.WARDEN_APP_ID }} | |
| private-key: ${{ secrets.WARDEN_PRIVATE_KEY }} | |
| owner: ${{ github.repository_owner }} # access to all repos, cause this is triggered on org level | |
| - uses: getsentry/warden@v0 | |
| id: warden | |
| continue-on-error: true # throw no error for now | |
| with: | |
| github-token: ${{ steps.app-token.outputs.token }} | |
| base-config-path: .warden-org/warden.toml | |
| - name: Authenticate to Google Cloud | |
| continue-on-error: true | |
| uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 | |
| with: | |
| workload_identity_provider: projects/868781662168/locations/global/workloadIdentityPools/prod-github/providers/github-oidc-pool | |
| service_account: gha-warden@sac-prod-sa.iam.gserviceaccount.com | |
| - name: Rename findings file with timestamp | |
| id: rename-findings | |
| if: always() && steps.warden.outputs.findings-file != '' | |
| env: | |
| FINDINGS_FILE: ${{ steps.warden.outputs.findings-file }} | |
| run: | | |
| DEST="$RUNNER_TEMP/$(date -u +%Y-%m-%dT%H%M%SZ).json" | |
| cp "$FINDINGS_FILE" "$DEST" | |
| echo "path=$DEST" >> "$GITHUB_OUTPUT" | |
| - name: Upload findings to GCS | |
| continue-on-error: true | |
| uses: google-github-actions/upload-cloud-storage@c0f6160ff80057923ff50e5e567695cea181ec23 # v2 | |
| if: always() && steps.rename-findings.outputs.path != '' | |
| with: | |
| path: ${{ steps.rename-findings.outputs.path }} | |
| destination: warden-logs/${{ github.repository }} |