Add the GitHub Action

Every pull request that touches a migration gets one evolving summary comment; the job fails on any finding (or whatever your team policy blocks on). Analysis runs in the hosted service — the action is a thin client — so a Free team's checks run the free rules, and Startup and above run the full corpus; connection-id and live-schema refinement need Startup.

name: Migration check
on: pull_request

permissions:
  contents: read         # read changed files
  pull-requests: write   # post the summary comment
  security-events: write # upload the SARIF log to code scanning

jobs:
  bolvrk:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0 # required: the action diffs base...head to find changed migrations
      - uses: bolvrk/bolvrk@v1
        with:
          token: ${{ secrets.BOLVRK_TOKEN }}
          migrations: "migrations/*.sql" # default; any glob works
          sarif-file: bolvrk.sarif        # optional: findings for code scanning
      - uses: github/codeql-action/upload-sarif@v3
        if: always()
        with:
          sarif_file: bolvrk.sarif

infofetch-depth: 0 is required — the action diffs base...head to find the changed migrations, and a shallow checkout has no base to diff against. Drop the upload-sarif step and security-events: write if you don't use code scanning.

Pull requests from forks have no secret and are skipped with a notice. A comment that cannot be posted is a warning, not a failure — the verdict follows the findings alone. The context sent with each check (the other migrations in the set) is capped at 20 MB; when the cap trims it, the action says so with a notice.

Inputs