warden.toml

version = 1

# Warden gates "security clearance" on a single question: does this diff
# introduce a new security issue? See .warden/skills/diff-security-review.
# The clearance itself is granted by .github/workflows/warden-clearance.yml.

[defaults]
reportOn = "low"
ignorePaths = [
  "**/node_modules/**",
  "**/pnpm-lock.yaml",
  "**/dist/**",
  "**/*.min.js",
]

[defaults.agent]
model = "openai/gpt-5.6-luna"

# Auxiliary verifies/merges findings and gates what survives to the report;
# keep it on the same strong model so weak verification can't cause a false
# clearance.
[defaults.auxiliary]
model = "openai/gpt-5.6-luna"

[[skills]]
name = "diff-security-review"

[[skills.triggers]]
type = "pull_request"
actions = ["opened", "synchronize", "reopened"]
draft = false

# Lets developers run `warden` locally on uncommitted changes before pushing.
[[skills.triggers]]
type = "local"