GitHub App: one click, no workflow
Install on an account or organisation from the dashboard and every pull request with a migration gets the check, a comment posted as Bolvrk, and a status you can require. No workflow file, no secret, fork pull requests covered.
The Action needs a workflow file, a repository secret and a pull request to land them. The App needs a click. Install it on a GitHub account or organisation from the dashboard; GitHub sends you straight back, the installation is linked to your team, and from then on every pull request that adds or changes a migration file is checked through the same hosted path the Action uses: same rules, same plan gate, same team policy, same run log.
It posts one evolving comment as Bolvrk and reports a check run named "Bolvrk migration check", which fails when a finding blocks under your policy, so it can be a required status in branch protection. Pull requests from forks work: the app authenticates with its own installation token and no repository secret is involved.
Which files, and what leaves the repository
The repository's bolvrk.json decides the migration globs and excludes when it has one; without it, every layout the CLI's framework detection knows counts, plus migrations/*.sql. The other migrations in the tree travel as set context so the ordering rules see the whole change, bounded in count and size.
File contents are read from GitHub, the credential rules run on them in the service, and then every literal and comment is stripped before the check request is built and stored, the same guarantee the CLI and the Action give. The app never connects to a database of yours.
The CLI is open source and needs no account: npx bolvrk check migration.sql