Summary

This PR adds support for scheduled/cron-based skill execution in Warden. This enables periodic repository scans that:

• Analyze files matching configured path patterns - Use glob patterns to target specific files for analysis
• Report findings via GitHub Issues - Creates or updates a tracking issue with a detailed findings summary
• Optionally create fix PRs - When skills provide suggested fixes, automatically creates PRs with those fixes applied

Motivation

Previously, Warden could only run skills in response to PR events. This limited its usefulness for:

• Weekly/monthly security audits
• Periodic code quality scans
• Compliance checks that need to run on the entire codebase
• Finding issues in code that was merged before Warden was set up

With scheduled triggers, teams can now run comprehensive repository-wide scans on a regular cadence.

Key Design Insight

The existing runner already supports file-based analysis. The CLI's buildFileEventContext() creates a synthetic pullRequest context from file globs, and the SDK runner processes it normally because the files have patch data.

For scheduled runs, we adapt this pattern:

1. Build context from paths filter using real repo info (not synthetic "local" values)
2. Run skills through the existing runner (no modifications needed)
3. Output to GitHub Issues instead of PR reviews
4. Optionally create fix PRs using Git API

New Features

1. New schedule Event Type

Triggers can now use event = "schedule" to run on GitHub Actions schedule or workflow_dispatch events:

[[triggers]]
name = "weekly-security-scan"
event = "schedule"
skill = "security-review"

[triggers.filters]
paths = ["src/**/*.ts", "src/**/*.js"]
ignorePaths = ["**/*.test.ts", "**/__tests__/**"]

2. Schedule-Specific Configuration

New [triggers.schedule] section for schedule-specific options:

[triggers.schedule]
issueTitle = "Weekly Security Scan Results"  # Custom issue title
createFixPR = true                            # Auto-create fix PRs
fixBranchPrefix = "security-fix"              # Branch prefix for fix PRs

3. GitHub Issue Reporting

Findings are rendered as a comprehensive GitHub Issue with:

• Run timestamp and commit SHA
• Severity summary table (Critical: X, High: Y, etc.)
• Findings grouped by file with line links
• Each finding includes title, severity badge, description
• Suggested fixes noted inline
• Warden branding footer

If an issue with the same title already exists, it's updated rather than creating duplicates.

4. Automated Fix PRs

When createFixPR = true and skills provide suggestedFix.diff:

• Collects all fixable findings
• Applies diffs to create modified files
• Creates a new branch via GitHub Git API
• Opens a PR with a summary of applied fixes

Files Changed

New Files

Modified Files

Example Configuration

warden.toml

version = 1

[[triggers]]
name = "weekly-security-scan"
event = "schedule"
skill = "security-review"

[triggers.filters]
paths = ["src/**/*.ts", "src/**/*.js"]
ignorePaths = ["**/*.test.ts", "**/__tests__/**"]

[triggers.schedule]
issueTitle = "Weekly Security Scan Results"
createFixPR = true
fixBranchPrefix = "security-fix"

[triggers.output]
failOn = "high"
labels = ["security", "automated"]

.github/workflows/warden-scheduled.yml

name: Warden Scheduled Scan

on:
  schedule:
    - cron: '0 0 * * 0'  # Every Sunday at midnight
  workflow_dispatch:      # Allow manual trigger

jobs:
  scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - uses: getsentry/warden-action@v1
        with:
          anthropic-api-key: ${{ secrets.ANTHROPIC_API_KEY }}
          github-token: ${{ secrets.GITHUB_TOKEN }}

Edge Cases Handled

Schema Validation

The schema enforces:

• actions is required for non-schedule events
• filters.paths is required for schedule events (must specify what to scan)

// actions is required unless event is 'schedule'
.refine((data) => {
  if (data.event !== 'schedule') {
    return data.actions !== undefined && data.actions.length > 0;
  }
  return true;
})

// paths filter is required for schedule events
.refine((data) => {
  if (data.event === 'schedule') {
    return data.filters?.paths !== undefined && data.filters.paths.length > 0;
  }
  return true;
})

Test Plan

• All existing tests pass (185 tests)
• TypeScript compilation succeeds
• ESLint passes
• Manual test: Create schedule trigger in test repo
• Manual test: Run with workflow_dispatch event
• Manual test: Verify issue creation/update behavior
• Manual test: Verify fix PR creation with applied diffs

🤖 Generated with Claude Code