GitHub Action
Add your team token as the BOLVRK_TOKEN repository secret and findings land on every pull request that touches a migration, one evolving comment, not a pile.
The Action is a thin client over the hosted API. It diffs base against head to find the changed migration files, sends them in path order so set-ordering rules see the whole change, and posts one summary comment on the pull request that it edits on every push instead of stacking new ones.
The job fails on findings at or above the team’s block threshold, any finding by default. On Free the free rules run; on Startup and above the full corpus runs, with live-schema context when a stored connection id is given.
permissions:
contents: read
pull-requests: write
security-events: write
steps:
- uses: actions/checkout@v4
with:
fetch-depth: 0
- uses: bolvrk/bolvrk@v1
with:
token: ${{ secrets.BOLVRK_TOKEN }}
migrations: "migrations/*.sql"
sarif-file: bolvrk.sarif
- uses: github/codeql-action/upload-sarif@v3
if: always()
with:
sarif_file: bolvrk.sarifBuilt for pull requests from strangers
Fork pull requests do not receive repository secrets. When the token is empty on a fork PR the Action prints a notice and exits 0 instead of failing the contributor’s build. A comment that cannot be posted is a warning, never a failure: the exit status follows the findings alone.
The comment says what ran. A clean result reads “no findings (no rule fired)”, and a Free-plan run ends with how many rules the plan skipped, so nobody mistakes a partial run for a full one.
Credential scan of CI logs
Tokens printed by a build or a test stay readable in the job log for ninety days. With scan-logs: true the action reads the logs of the run's finished jobs and scans them with the credential rules on the runner, sending nothing: a hit is an annotation plus a job summary with the value masked, and the job fails so the rotation happens now. scan-paths does the same for files the workflow produced. Put the step in a final job that needs: the others, with actions: read; a scan-only job needs no team token.
The CLI is open source and needs no account: npx bolvrk check migration.sql