fix(ci): auth warlock triage with the CI gateway token file - #395
Merged
Merged
Conversation
The wizard gateway moved CI callers to a pre-issued bearer supplied through a token file against ai-gateway.<region>.posthog.com (see PostHog/wizard#1240). Write the shared CI bot gateway secret to a file and pass it via CONTEXT_MILL_WARLOCK_GATEWAY_TOKEN_FILE, sent as Authorization: Bearer, replacing the personal-API-key auth. Generated-By: PostHog Desktop Task-Id: 5f9d544a-ef47-488d-bd47-a8e7c61a6583 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
🧙 Wizard CIRun the Wizard CI and test your changes against wizard-workbench example apps by replying with a GitHub comment using one of the following commands: Test all apps:
Test all apps in a directory:
Test an individual app:
Show more apps
Test against a wizard branch:
Add Results will be posted here when complete. |
edwinyjlim
approved these changes
Sep 15, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
Warlock's LLM triage stopped authenticating against the gateway (e.g. this run): every YARA match logged
LLM provider call failed — defaulting to true positive, so 401 routine false positives failed the build. The gateway retired personal-API-key auth for CI callers: PostHog/wizard#1240 moved CI to a pre-issued gateway bearer supplied through a token file againsthttps://ai-gateway.<region>.posthog.com, and PostHog/wizard-workbench#3875 established the CI-side pattern.#393 hot-patched the script onto the gateway's
ciproduct with the personal key; this PR replaces that with the sanctioned token-file mechanism.Changes
scripts/scan-warlock.js: read the bearer from the file named byCONTEXT_MILL_WARLOCK_GATEWAY_TOKEN_FILE(withANTHROPIC_AUTH_TOKEN/ANTHROPIC_BASE_URLas local overrides), targetai-gateway.<region>.posthog.com, and send it asAuthorization: Bearervia the SDK'sauthTokeninstead ofapiKey(x-api-key). Missing or empty token keeps the existing no-triage fallback.build.yml/build-release.yml: writeGH_APP_POSTHOG_WIZARD_CI_BOT_POSTHOG_GATEWAY_TOKEN(org secret, already visible to this repo) to$RUNNER_TEMP/gateway-tokenand point the scan at it. Fork PRs still get an empty token → annotate-only via the existingcontinue-on-error.Test plan
npm test: 207 tests pass.LLM triage enabledwith real triage verdicts (no "LLM provider call failed").Created with PostHog Desktop
🤖 Generated with Claude Code