fix(sanic): Gate url.full, url.path, and http.query behind send_default_pii #1953
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Warden | |
| on: | |
| pull_request: | |
| types: [opened, synchronize, reopened] | |
| jobs: | |
| check-permissions: | |
| runs-on: ubuntu-latest | |
| outputs: | |
| HAS_SECRETS: ${{ steps.check.outputs.HAS_SECRETS }} | |
| steps: | |
| - run: echo "HAS_SECRETS=${{ secrets.WARDEN_PRIVATE_KEY != '' }}" >> "$GITHUB_OUTPUT" | |
| id: check | |
| warden: | |
| runs-on: ubuntu-latest | |
| needs: check-permissions | |
| if: ${{ needs.check-permissions.outputs.HAS_SECRETS == 'true' }} | |
| permissions: | |
| contents: read | |
| pull-requests: read | |
| id-token: write | |
| env: | |
| WARDEN_ANTHROPIC_API_KEY: ${{ secrets.WARDEN_ANTHROPIC_API_KEY }} | |
| WARDEN_MODEL: ${{ secrets.WARDEN_MODEL }} | |
| WARDEN_SENTRY_DSN: ${{ secrets.WARDEN_SENTRY_DSN }} | |
| steps: | |
| - name: Checkout Code | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| - name: Checkout Org GitHub Repo | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| with: | |
| repository: ${{ github.repository_owner }}/.github | |
| path: .warden-org | |
| - name: Analyze | |
| id: warden-analyze | |
| uses: getsentry/warden@v0 | |
| continue-on-error: true | |
| with: | |
| mode: analyze | |
| base-config-path: .warden-org/warden.toml | |
| - uses: actions/create-github-app-token@29824e69f54612133e76f7eaac726eef6c875baf # v2.2.1 | |
| id: app-token | |
| if: ${{ always() && steps.warden-analyze.outputs.findings-file != '' }} | |
| with: | |
| app-id: ${{ secrets.WARDEN_APP_ID }} | |
| private-key: ${{ secrets.WARDEN_PRIVATE_KEY }} | |
| owner: ${{ github.repository_owner }} # access to all repos, cause this is triggered on org level | |
| - name: Report | |
| if: ${{ always() && steps.warden-analyze.outputs.findings-file != '' && steps.app-token.outcome == 'success' }} | |
| uses: getsentry/warden@v0 | |
| continue-on-error: true | |
| with: | |
| mode: report | |
| findings-file: ${{ steps.warden-analyze.outputs.findings-file }} | |
| github-token: ${{ steps.app-token.outputs.token }} | |
| base-config-path: .warden-org/warden.toml | |
| - name: Authenticate to Google Cloud | |
| if: ${{ always() && steps.warden-analyze.outputs.findings-file != '' }} | |
| continue-on-error: true | |
| uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 | |
| with: | |
| workload_identity_provider: projects/868781662168/locations/global/workloadIdentityPools/prod-github/providers/github-oidc-pool | |
| service_account: gha-warden@sac-prod-sa.iam.gserviceaccount.com | |
| - name: Rename findings file with timestamp | |
| id: rename-findings | |
| if: ${{ always() && steps.warden-analyze.outputs.findings-file != '' }} | |
| env: | |
| FINDINGS_FILE: ${{ steps.warden-analyze.outputs.findings-file }} | |
| run: | | |
| DEST="$RUNNER_TEMP/$(date -u +%Y-%m-%dT%H%M%SZ).json" | |
| cp "$FINDINGS_FILE" "$DEST" | |
| echo "path=$DEST" >> "$GITHUB_OUTPUT" | |
| - name: Upload findings to GCS | |
| continue-on-error: true | |
| uses: google-github-actions/upload-cloud-storage@c0f6160ff80057923ff50e5e567695cea181ec23 # v2 | |
| if: ${{ always() && steps.rename-findings.outputs.path != '' }} | |
| with: | |
| path: ${{ steps.rename-findings.outputs.path }} | |
| destination: warden-logs/${{ github.repository }} |