fix(warden): Fail clearly when credentials are unavailable (#202)

Co-authored-by: sentry-junior[bot] <264270552+sentry-junior[bot]@users.noreply.github.com>
Co-authored-by: junior <noreply@getsentry.com>
Co-authored-by: David Cramer <david@sentry.io>

Author: 3 people

.github/workflows/warden.yml

@@ -5,18 +5,8 @@ on:
     types: [opened, synchronize, reopened]
 
 jobs:
-  check-permissions:
-    runs-on: ubuntu-latest
-    outputs:
-      HAS_SECRETS: ${{ steps.check.outputs.HAS_SECRETS }}
-    steps:
-      - run: echo "HAS_SECRETS=${{ secrets.WARDEN_PRIVATE_KEY != '' }}" >> "$GITHUB_OUTPUT"
-        id: check
-
   warden:
     runs-on: ubuntu-latest
-    needs: check-permissions
-    if: ${{ needs.check-permissions.outputs.HAS_SECRETS == 'true' }}
     permissions:
         contents: read
         pull-requests: read
@@ -26,6 +16,28 @@ jobs:
       WARDEN_MODEL: ${{ secrets.WARDEN_MODEL }}
       WARDEN_SENTRY_DSN: ${{ secrets.WARDEN_SENTRY_DSN }}
     steps:
+      - name: Check Warden credentials
+        env:
+          HAS_OPENROUTER_API_KEY: ${{ secrets.WARDEN_OPENROUTER_API_KEY != '' }}
+          IS_FORK: ${{ github.event.pull_request.head.repo.full_name != github.repository }}
+          IS_DEPENDABOT: ${{ github.actor == 'dependabot[bot]' }}
+        run: |
+          if [[ "$HAS_OPENROUTER_API_KEY" == "true" ]]; then
+            exit 0
+          fi
+
+          if [[ "$IS_FORK" == "true" ]]; then
+            MESSAGE="Warden cannot review this fork pull request because GitHub withholds repository secrets from fork workflows."
+          elif [[ "$IS_DEPENDABOT" == "true" ]]; then
+            MESSAGE="Warden cannot review this Dependabot pull request because WARDEN_OPENROUTER_API_KEY is unavailable. Add it to the organization Dependabot secrets."
+          else
+            MESSAGE="Warden cannot review this pull request because WARDEN_OPENROUTER_API_KEY is unavailable. Add it to the organization Actions secrets."
+          fi
+
+          echo "::error::$MESSAGE"
+          printf '## Warden unavailable\n\n%s\n' "$MESSAGE" >> "$GITHUB_STEP_SUMMARY"
+          exit 1
+
       - name: Checkout Code
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
@@ -38,7 +50,6 @@ jobs:
       - name: Analyze
         id: warden-analyze
         uses: getsentry/warden@v0
-        continue-on-error: true
         with:
           mode: analyze
           base-config-path: .warden-org/warden.toml
@@ -54,7 +65,6 @@ jobs:
       - name: Report
         if: ${{ always() && steps.warden-analyze.outputs.findings-file != '' && steps.app-token.outcome == 'success' }}
         uses: getsentry/warden@v0
-        continue-on-error: true
         with:
           mode: report
           findings-file: ${{ steps.warden-analyze.outputs.findings-file }}