fix: update warden CI auth to use CLAUDE_CODE_OAUTH_TOKEN

[gricha]

Summary

• Switch from anthropic-api-key input to CLAUDE_CODE_OAUTH_TOKEN env var (from WARDEN_ANTHROPIC_API_KEY secret)
• Add fetch-depth: 0 so warden can diff against base branch
• Strip newlines from OAuth token to avoid auth failures

[github-actions]

⚠️ OAuth token prefix logged to workflow output (high confidence)

Line 33 logs the first 10 characters of the OAuth token to workflow logs. Workflow logs are often publicly accessible and can aid attackers in token compromise.

Suggested fix: Remove the token prefix logging. Only log non-sensitive metadata.

_{Identified by Warden via security-review · high, high confidence}

[github-actions]

🟠 OAuth token length logged to workflow output (high confidence)

Line 32 logs the token length, which provides metadata that could assist in token compromise attempts.

Suggested fix: Remove token length logging to avoid exposing token metadata.

_{Identified by Warden via security-review · medium, high confidence}

[github-actions]

🟠 GitHub Action not pinned to commit hash (high confidence)

Line 54 uses an unpinned action reference (@fix/propagate-sdk-errors) which could change maliciously. Actions should be pinned to specific commit hashes.

_{Identified by Warden via security-review · medium, high confidence}

[github-actions]

🟠 Unnecessary derived state - compute workspaceCount inline (high confidence)

workspaceCount is derived state synced via useEffect. Compute it directly as const workspaceCount = workspaces?.length || 0 instead.

Suggested fix: Remove useState and useEffect, compute workspaceCount directly from workspaces

Suggested change

	useEffect(() => {
	setWorkspaceCount(workspaces?.length || 0);
	}, [workspaces]);
	const workspaceCount = workspaces?.length || 0;

_{Identified by Warden via code-simplifier · medium, high confidence}

[github-actions]

🟠 Derived state synced via useEffect instead of computed inline (high confidence)

totalCount, runningCount, and filteredWorkspaces should be computed directly from workspaces, not synced to state via useEffect.

Suggested fix: Remove state variables and compute values inline

Suggested change

	useEffect(() => {
	setTotalCount(workspaces?.length || 0)
	setRunningCount(workspaces?.filter(ws => ws.status === 'running').length || 0)
	setFilteredWorkspaces(workspaces || [])
	}, [workspaces])
	const filteredWorkspaces = workspaces || []
	const totalCount = filteredWorkspaces.length
	const runningCount = filteredWorkspaces.filter(ws => ws.status === 'running').length

_{Identified by Warden via code-simplifier · medium, high confidence}

[github-actions]

🟠 Component defined inside another component (high confidence)

WorkspaceStats is defined inside WorkspaceList, causing it to be recreated on every render. Move it outside the component.

Suggested fix: Move WorkspaceStats outside of WorkspaceList component

Suggested change

	function WorkspaceStats({ workspaces }: { workspaces: WorkspaceInfo[] }) {
	const running = workspaces.filter(ws => ws.status === 'running').length
	return (
	<div className="grid grid-cols-2 sm:grid-cols-4 gap-3">
	<StatCard value={workspaces.length} label="Workspaces" />
	<StatCard value={running} label="Running" accent={running > 0} />
	<StatCard value={workspaces.length - running} label="Stopped" />
	<StatCard value="—" label="Sessions" />
	</div>
	)
	}
	function WorkspaceStats({ workspaces }: { workspaces: WorkspaceInfo[] }) {
	const running = workspaces.filter(ws => ws.status === 'running').length
	return (
	<div className="grid grid-cols-2 sm:grid-cols-4 gap-3">
	<StatCard value={workspaces.length} label="Workspaces" />
	<StatCard value={running} label="Running" accent={running > 0} />
	<StatCard value={workspaces.length - running} label="Stopped" />
	<StatCard value="—" label="Sessions" />
	</div>
	)
	}

_{Identified by Warden via code-simplifier · medium, high confidence}

[github-actions]

🟠 Direct DOM manipulation instead of React patterns (high confidence)

Using document.querySelector and classList instead of React refs or state. This bypasses React's rendering model.

_{Identified by Warden via code-simplifier · medium, high confidence}

[github-actions]

🟠 Array index used as key in list rendering (high confidence)

Using array index as key can cause issues with component state and performance. Use workspace.name as the unique identifier.

Suggested fix: Use workspace.name instead of index as key

Suggested change

	key={index}
	{filteredWorkspaces.map((ws: WorkspaceInfo) => (
	key={ws.name}

_{Identified by Warden via code-simplifier · medium, high confidence}

[github-actions]

🟠 Unnecessary derived state synchronized via useEffect (high confidence)

totalCount, runningCount, and filteredWorkspaces are derived from workspaces and should be computed inline instead of stored in state and synced via useEffect.

Suggested fix: Remove state variables and compute values inline

Suggested change

	useEffect(() => {
	setTotalCount(workspaces?.length || 0)
	setRunningCount(workspaces?.filter(ws => ws.status === 'running').length || 0)
	setFilteredWorkspaces(workspaces || [])
	}, [workspaces])
	const totalCount = workspaces?.length || 0
	const runningCount = workspaces?.filter(ws => ws.status === 'running').length || 0
	const filteredWorkspaces = workspaces || []

_{Identified by Warden via code-simplifier · medium, high confidence}

[github-actions]

🟠 useEffect with missing dependencies (high confidence)

useEffect depends on navigate and showCreate but only lists workspaces in dependencies array.

Suggested fix: Add missing dependencies to useEffect

Suggested change

	useEffect(() => {
	if (workspaces && workspaces.length === 1 && !showCreate) {
	navigate(`/workspaces/${workspaces[0].name}/sessions`)
	}
	}, [workspaces])
	}, [workspaces, navigate, showCreate])

_{Identified by Warden via code-simplifier · medium, high confidence}

[github-actions]

🟠 Array index used as key in list rendering (high confidence)

Using index as key can cause rendering issues. Use workspace.name which is unique.

Suggested fix: Use workspace.name as key instead of index

Suggested change

	{filteredWorkspaces.map((ws: WorkspaceInfo, index: number) => (
	<WorkspaceRow
	key={ws.name}
	key={index}
	workspace={ws}
	onClick={() => handleRowClick(ws)}
	onClick={() => navigate(`/workspaces/${ws.name}/sessions`)}
	/>
	))}
	{filteredWorkspaces.map((ws: WorkspaceInfo) => (
	key={ws.name}

_{Identified by Warden via code-simplifier · medium, high confidence}

rtfrtrwewer