ci: Warden security clearance for PR diffs - #3379
Merged
Merged
Conversation
Warden runs a single custom skill (diff-security-review) on every PR to dev and answers one question: does this diff introduce a new security issue? A workflow_run gatekeeper grants a 'security clearance' review when the diff is clean, satisfying the required-review gate in the branch ruleset. Humans still review and merge. - Clearance identity is a dedicated GitHub App that never pushes, so require_last_push_approval holds by construction. - The gatekeeper executes from the default branch and refuses to clear PRs touching .github/, warden.toml, .warden/, or agent skill dirs. - dismiss_stale_reviews_on_push revokes clearance on every new push; Warden re-runs and re-clears if still clean. - No-ops until WARDEN_MODEL, WARDEN_ANTHROPIC_API_KEY, WARDEN_APP_ID, and WARDEN_PRIVATE_KEY secrets are configured.
Contributor
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
benjaminshafii
marked this pull request as draft
July 31, 2026 11:26
- Drop ready_for_review trigger: warden.toml cannot match it, so the run would report findings_count=0 without analyzing and wrongly grant clearance on draft-to-ready PRs. - Skip fork PRs in warden.yml (no secrets on forks; clearance already fork-blocked downstream) instead of failing red. - Add timeout-minutes to both jobs and serialize clearance runs per branch (queued, not cancelled, so revokes are never killed).
Agent and auxiliary lanes both use gpt-5.6-luna: auxiliary verification gates which findings survive, so it stays on the same strong model to avoid false clearances. Secret becomes WARDEN_OPENAI_API_KEY. Validated locally against the real CLI: injection+XSS diff -> 1 high (same-root-cause merge), XSS-only diff -> 1 high, clean diff -> 0 findings. 3-7s per run.
benjaminshafii
marked this pull request as ready for review
August 1, 2026 09:19
Deploying openwork with
|
| Latest commit: |
463ff2a
|
| Status: | ✅ Deploy successful! |
| Preview URL: | https://7f438411.openwork.pages.dev |
| Branch Preview URL: | https://warden-diff-security-clearan.openwork.pages.dev |
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
Addresses Warden's own finding on this PR: the token-minting action ran from a mutable tag while holding the app private key. All actions in both workflows are now SHA-pinned.
Resolving review threads via GraphQL requires contents:write on the GITHUB_TOKEN; without it the report step fails after fix evaluation and stale findings block merge under thread-resolution rules.
Fixes both open CodeQL actions/missing-workflow-permissions alerts; neither job writes to the repo or GitHub API.
benjaminshafii
enabled auto-merge (squash)
August 1, 2026 14:15
src-opn
approved these changes
Aug 1, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
diff-security-review, which answers a single question: does this diff introduce a new security issue?devbranch ruleset. Humans still review and merge — this only removes the wait-for-review blocker on clean diffs.clear/flagged.Why
devrequires 1 approving review withrequire_last_push_approval. Clean PRs (docs, chores, agent-authored fixes) stall waiting for a reviewer. This gives them an independent, automated security gate while keeping humans on the merge button and on anything the gate refuses to clear.Issue
Scope
warden.toml— single skill, PR trigger (+localtrigger so devs can runwardenbefore pushing).warden/skills/diff-security-review/SKILL.md— the custom prompt (new security issues only; explicit do-not-report list).github/workflows/warden.yml— analyze + report on PRs todev, uploads{head_sha, findings_count}summary artifact.github/workflows/warden-clearance.yml—workflow_rungatekeeper: grants clearance onclear, revokes onflagged, refuses (guarded) when the PR touches review machinery.gitignore— ignore.warden/logs/Out of scope
--fix,createFixPR) — intentionally off; the clearance identity must never pushTesting
Ran
actionlint .github/workflows/warden.yml .github/workflows/warden-clearance.ymlpnpm dlx @sentry/warden preview-server.ts --json --log,anthropic/claude-sonnet-4-6, team Anthropic key) against three scratch diffs:/tmpoutput path)Result
flagged/tmp/preview.png) ->flagged(legitimate catch, not planted)clearCI status
warden.ymlneedsWARDEN_ANTHROPIC_API_KEY;warden-clearance.ymllogs "clearance disabled" withoutWARDEN_APP_ID)Manual verification
Admin setup required first:
npx @sentry/warden setup-app --org different-ai(name e.g. "Warden Clearance"; needs only Pull requests: write, Contents: read; never pushes)WARDEN_ANTHROPIC_API_KEY(+ optionalWARDEN_MODEL); environmentwarden-clearancerestricted todevwithWARDEN_APP_ID,WARDEN_PRIVATE_KEYThen prove end-to-end on live PRs:
.github/**-> expectguarded, no clearance (this PR itself demonstrates that case)Evidence
Risk
findings_count == 0(any severity blocks clearance)..github/+warden.toml) — review-machinery changes always need a human.Rollback