Repository navigation
chore(warden): Add sdk-review skill and run built-in code-review - #8247
Merged
Merged
Conversation
Add a report-only sdk-review Warden skill for SDK contract violations. Stop committing dotagents-managed skills so Warden resolves code-review to its built-in, as in sentry-dotnet and sentry-go. Co-Authored-By: Johannes Daxböck <114897+dingsdax@users.noreply.github.com>
…ecurity-review The org base config wins over a repo security-review entry, so the repo block never ran. skill-scanner was reviewing every changed file; it now only runs on agent skill and instruction files. Co-Authored-By: Johannes Daxböck <114897+dingsdax@users.noreply.github.com>
The unquoted colon made the YAML frontmatter invalid, so Warden could not load the skill. Co-Authored-By: Johannes Daxböck <114897+dingsdax@users.noreply.github.com>
Co-Authored-By: Johannes Daxböck <114897+dingsdax@users.noreply.github.com>
Matches sentry-dotnet. Large draft test PRs cost about $30 per push. Co-Authored-By: Johannes Daxböck <114897+dingsdax@users.noreply.github.com>
Co-Authored-By: Johannes Daxböck <114897+dingsdax@users.noreply.github.com>
Contributor
Coverage Results 📊✅ 139110 passed | ⏭️ 7765 skipped | Total: 146875 | Pass Rate: 94.71% | Execution Time: 436m 35s 📊 Comparison with Base Branch
✨ Test counts unchanged from base. All tests are passing successfully. ✅ Patch coverage is 100.00% (no changed executable lines found; target 80%). Coverage diff@@ Coverage Diff @@
## master #8247 +/-##
==========================================
- Coverage 90.24% 90.21% -0.03%
==========================================
Files 203 203 —
Tracked lines 27125 27229 +104
Branches 10142 10198 +56
==========================================
+ Hits 24478 24564 +86
- Misses 2647 2665 +18
- Partials 1541 1555 +14Generated by Coverage Action |
Name the data_collection gate instead of send_default_pii, and drop rules that contradict the team's Bugbot rules (Go Close/overflow, Python stream exceptions). Co-Authored-By: Johannes Daxböck <114897+dingsdax@users.noreply.github.com>
Automatic collection goes through the denylist filter; user-set data is never gated (develop-docs data-collection spec). Co-Authored-By: Johannes Daxböck <114897+dingsdax@users.noreply.github.com>
Co-Authored-By: Johannes Daxböck <114897+dingsdax@users.noreply.github.com>
alexander-alderman-webb
approved these changes
Nov 11, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Part of a pilot to see if Warden can replace Bugbot for backend SDK review.
sdk-review(.agents/skills/sdk-review/SKILL.md) is a minimal, report-only skill for Sentry SDK contract violations (host-app safety, data-collection gates, supported versions, public API, plus a few language-specific rules taken from Bugbot findings people acted on). Generic logic bugs are left to Warden's built-incode-review. Nothing here fails checks. I ran Warden v0.53.0 locally and the skill loads from.agents/skills/sdk-review.Aligns the repo with sentry-dotnet and sentry-go:
agents.lockand.agents/.gitignoreare ignored, asdotagentsrecommends, and the legacygitignore = falseis gone. Warden prefers repo-local skills over its built-ins, so the committed.agents/skills/code-review(the getsentry/skills checklist) was shadowing Warden's built-incode-review. A local run now resolvescode-reviewto the built-in.skill-scannerloads fromgetsentry/skillsremotely and only runs on agent skill and instruction files. Before, it reviewed every changed file (53–61 min on recent large PRs). The org config ignores**/*.md, so for now it can't readSKILL.mdorAGENTS.md; fixing that needs a change to the orgwarden.toml.code-reviewskipsuv.lockand the generatedtest-integrations-*.ymlworkflows.security-reviewblock is removed. The org base config always wins over it, so it never ran ("Using the base config skill and ignoring the repo config duplicate" in the Warden logs).For reviewers: after merging, local agent skills come from
dotagents installinstead of the checkout.Refs SDK-1580
via @dingsdax.
--
View Session [Sentry]