fix(serializer): avoid copying the whole Mapping before trimming to MAX_DATABAG_BREADTH #2156
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Warden | |
| on: | |
| pull_request: | |
| types: [opened, synchronize, reopened] | |
| jobs: | |
| check-permissions: | |
| runs-on: ubuntu-latest | |
| outputs: | |
| HAS_SECRETS: ${{ steps.check.outputs.HAS_SECRETS }} | |
| steps: | |
| - run: echo "HAS_SECRETS=${{ secrets.WARDEN_PRIVATE_KEY != '' }}" >> "$GITHUB_OUTPUT" | |
| id: check | |
| warden: | |
| runs-on: ubuntu-latest | |
| needs: check-permissions | |
| if: ${{ needs.check-permissions.outputs.HAS_SECRETS == 'true' }} | |
| permissions: | |
| contents: read | |
| pull-requests: read | |
| id-token: write | |
| env: | |
| WARDEN_ANTHROPIC_API_KEY: ${{ secrets.WARDEN_ANTHROPIC_API_KEY }} | |
| WARDEN_OPENROUTER_API_KEY: ${{ secrets.WARDEN_OPENROUTER_API_KEY }} | |
| WARDEN_MODEL: ${{ secrets.WARDEN_MODEL }} | |
| WARDEN_SENTRY_DSN: ${{ secrets.WARDEN_SENTRY_DSN }} | |
| steps: | |
| - name: Checkout Code | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| - name: Checkout Org GitHub Repo | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| with: | |
| repository: ${{ github.repository_owner }}/.github | |
| path: .warden-org | |
| - name: Analyze | |
| id: warden-analyze | |
| uses: getsentry/warden@v0 | |
| continue-on-error: true | |
| with: | |
| mode: analyze | |
| base-config-path: .warden-org/warden.toml | |
| - uses: actions/create-github-app-token@29824e69f54612133e76f7eaac726eef6c875baf # v2.2.1 | |
| id: app-token | |
| if: ${{ always() && steps.warden-analyze.outputs.findings-file != '' }} | |
| with: | |
| app-id: ${{ secrets.WARDEN_APP_ID }} | |
| private-key: ${{ secrets.WARDEN_PRIVATE_KEY }} | |
| owner: ${{ github.repository_owner }} # access to all repos, cause this is triggered on org level | |
| - name: Report | |
| if: ${{ always() && steps.warden-analyze.outputs.findings-file != '' && steps.app-token.outcome == 'success' }} | |
| uses: getsentry/warden@v0 | |
| continue-on-error: true | |
| with: | |
| mode: report | |
| findings-file: ${{ steps.warden-analyze.outputs.findings-file }} | |
| github-token: ${{ steps.app-token.outputs.token }} | |
| base-config-path: .warden-org/warden.toml | |
| - name: Authenticate to Google Cloud | |
| if: ${{ always() && steps.warden-analyze.outputs.findings-file != '' }} | |
| continue-on-error: true | |
| uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 | |
| with: | |
| workload_identity_provider: projects/868781662168/locations/global/workloadIdentityPools/prod-github/providers/github-oidc-pool | |
| service_account: gha-warden@sac-prod-sa.iam.gserviceaccount.com | |
| - name: Rename findings file with timestamp | |
| id: rename-findings | |
| if: ${{ always() && steps.warden-analyze.outputs.findings-file != '' }} | |
| env: | |
| FINDINGS_FILE: ${{ steps.warden-analyze.outputs.findings-file }} | |
| run: | | |
| DEST="$RUNNER_TEMP/$(date -u +%Y-%m-%dT%H%M%SZ).json" | |
| cp "$FINDINGS_FILE" "$DEST" | |
| echo "path=$DEST" >> "$GITHUB_OUTPUT" | |
| - name: Upload findings to GCS | |
| continue-on-error: true | |
| uses: google-github-actions/upload-cloud-storage@c0f6160ff80057923ff50e5e567695cea181ec23 # v2 | |
| if: ${{ always() && steps.rename-findings.outputs.path != '' }} | |
| with: | |
| path: ${{ steps.rename-findings.outputs.path }} | |
| destination: warden-logs/${{ github.repository }} |