GitHub Action
Add your team token as the BOLVRK_TOKEN repository secret and findings land on every pull request that touches a migration — one evolving comment, not a pile.
The Action is a thin client over the hosted API. It diffs base against head to find the changed migration files, sends them in path order so set-ordering rules see the whole change, and posts one summary comment on the pull request that it edits on every push instead of stacking new ones.
The job fails on findings at or above the team’s block threshold — any finding by default. On Free the free rules run; on Startup and above the full corpus runs, with live-schema context when a stored connection id is given.
permissions:
contents: read
pull-requests: write
security-events: write
steps:
- uses: actions/checkout@v4
with:
fetch-depth: 0
- uses: bolvrk/bolvrk@v1
with:
token: ${{ secrets.BOLVRK_TOKEN }}
migrations: "migrations/*.sql"
sarif-file: bolvrk.sarif
- uses: github/codeql-action/upload-sarif@v3
if: always()
with:
sarif_file: bolvrk.sarifBuilt for pull requests from strangers
Fork pull requests do not receive repository secrets. When the token is empty on a fork PR the Action prints a notice and exits 0 instead of failing the contributor’s build. A comment that cannot be posted is a warning, never a failure: the exit status follows the findings alone.
The comment says what ran. A clean result reads “no findings (no rule fired)”, and a Free-plan run ends with how many rules the plan skipped, so nobody mistakes a partial run for a full one.
The CLI is open source and needs no account: npx bolvrk check migration.sql