feat: add warlock v1

.github/workflows/build-release.yml

@@ -39,6 +39,22 @@ jobs:
         with:
           version: latest
 
+      # TODO: Remove these two steps once @posthog/warlock is published to npm.
+      # They exist because warlock is currently installed as a private git dependency,
+      # so the CI runner needs credentials to clone it.
+      - name: Generate token for private dependencies
+        id: app-token
+        uses: actions/create-github-app-token@v1
+        with:
+          app-id: ${{ secrets.GH_APP_POSTHOG_WIZARD_CI_BOT_APP_ID }}
+          private-key: ${{ secrets.GH_APP_POSTHOG_WIZARD_CI_BOT_PRIVATE_KEY }}
+          repositories: warlock
+
+      - name: Configure git auth for private deps
+        env:
+          APP_TOKEN: ${{ steps.app-token.outputs.token }}
+        run: git config --global url."https://x-access-token:${APP_TOKEN}@github.com/".insteadOf "https://github.com/"
+
       - name: Install dependencies
         run: pnpm install
 
@@ -114,8 +130,8 @@ jobs:
         env:
           BUILD_VERSION: ${{ steps.version.outputs.version }}
 
-      - name: Scan skills for prompt injection
-        run: bash scripts/scan-prompt-injection.sh dist/skills
+      - name: Scan skills with Warlock
+        run: node scripts/scan-warlock.js dist/skills
 
       - name: List build artifacts
         run: |

.github/workflows/build.yml

@@ -27,14 +27,30 @@ jobs:
       with:
         version: latest
 
+    # TODO: Remove these two steps once @posthog/warlock is published to npm.
+    # They exist because warlock is currently installed as a private git dependency,
+    # so the CI runner needs credentials to clone it.
+    - name: Generate token for private dependencies
+      id: app-token
+      uses: actions/create-github-app-token@v1
+      with:
+        app-id: ${{ secrets.GH_APP_POSTHOG_WIZARD_CI_BOT_APP_ID }}
+        private-key: ${{ secrets.GH_APP_POSTHOG_WIZARD_CI_BOT_PRIVATE_KEY }}
+        repositories: warlock
+
+    - name: Configure git auth for private deps
+      env:
+        APP_TOKEN: ${{ steps.app-token.outputs.token }}
+      run: git config --global url."https://x-access-token:${APP_TOKEN}@github.com/".insteadOf "https://github.com/"
+
     - name: Install dependencies
       run: pnpm install
 
     - name: Build
       run: pnpm build
 
-    - name: Scan skills for prompt injection
-      run: bash scripts/scan-prompt-injection.sh dist/skills
+    - name: Scan skills with Warlock
+      run: node scripts/scan-warlock.js dist/skills
 
     - name: Lint env var naming conventions
       run: bash scripts/lint-env-naming.sh

package.json

@@ -10,13 +10,17 @@
     "test:plugins:watch": "vitest scripts/plugins/tests",
     "test:skills": "vitest run scripts/lib/tests",
     "test:skills:watch": "vitest scripts/lib/tests",
-    "test": "vitest run scripts/plugins/tests scripts/lib/tests"
+    "test": "vitest run scripts/plugins/tests scripts/lib/tests",
+    "security-scan": "node scripts/scan-warlock.js",
+    "security-scan:skills": "node scripts/scan-warlock.js dist/skills"
   },
   "devDependencies": {
     "archiver": "^7.0.1",
     "vitest": "^2.0.0"
   },
   "dependencies": {
+    "@anthropic-ai/sdk": "^0.95.0",
+    "@posthog/warlock": "git+https://github.com/PostHog/warlock.git",
     "gray-matter": "^4.0.3",
     "js-yaml": "^4.1.1"
   }

pnpm-workspace.yaml

@@ -0,0 +1,2 @@
+onlyBuiltDependencies:
+  - "@posthog/warlock"