Bevor Security Action

GitHub Action that runs Bevor AI smart contract security analysis on every pull request, uploads findings to the Bevor dashboard, and posts a summary comment directly on the PR.

Quick start

# .github/workflows/bevor.yml
name: Bevor Security Analysis

on:
  pull_request:
    types: [opened, synchronize, reopened]

jobs:
  bevor-security:
    runs-on: ubuntu-latest
    permissions:
      pull-requests: write
      contents: read
    steps:
      - uses: actions/checkout@v4
      - uses: bevor-ai/bevor-action@v1
        with:
          api_key: ${{ secrets.BEVOR_API_KEY }}
          project_id: ${{ secrets.BEVOR_PROJECT_ID }}

Prerequisites

1. A Bevor account with an API key (sk_…) — generate one from Settings → API Keys.
2. A Bevor project ID — visible in the project URL or dashboard.
3. Add both as GitHub repository secrets:
   • BEVOR_API_KEY
   • BEVOR_PROJECT_ID

Inputs

Input	Required	Default	Description
api_key	✅	—	Bevor API key (sk_…)
project_id	✅	—	Bevor project ID
github_token		${{ github.token }}	Token used to post PR comments
base_url		https://api.bevor.io	Bevor API base URL
working_directory		.	Sub-directory to scan (relative to repo root)
fail_on_findings		false	Exit non-zero when findings at or above min_severity are found
min_severity		low	Minimum severity to report (low, medium, high, critical)
timeout_seconds		600	Max seconds to wait for analysis completion
poll_interval		15	Seconds between status polls

Outputs

Output	Description
analysis_id	Bevor analysis ID for this run
n_findings	Total number of findings
analysis_status	Final analysis status (success, partial, failed)

What it does

1. Packages the target directory (respecting .gitignore-style rules).
2. Uploads the code to Bevor as a new code version.
3. Creates a new analysis tied to your project.
4. Runs the analysis and waits for it to finish.
5. Fetches all findings from the completed analysis.
6. Comments a findings summary on the PR (creates or updates a single comment).
7. Optionally fails the job when findings at or above the configured severity are present.

PR comment example

The action posts (and updates on subsequent pushes) a single comment that looks like:

## Bevor Security Analysis

3 findings detected:

| Severity  | Count |
|:----------|------:|
| 🔴 Critical | 1   |
| 🟠 High     | 2   |

<details>
<summary>View all findings</summary>
...
</details>

View full analysis on Bevor

Advanced example

- uses: bevor-ai/bevor-action@v1
  with:
    api_key: ${{ secrets.BEVOR_API_KEY }}
    project_id: ${{ secrets.BEVOR_PROJECT_ID }}
    working_directory: './contracts'
    min_severity: 'medium'
    fail_on_findings: 'true'
    timeout_seconds: '900'

Use the outputs in a subsequent step:

- uses: bevor-ai/bevor-action@v1
  id: bevor
  with:
    api_key: ${{ secrets.BEVOR_API_KEY }}
    project_id: ${{ secrets.BEVOR_PROJECT_ID }}

- name: Print summary
  run: |
    echo "Analysis: ${{ steps.bevor.outputs.analysis_id }}"
    echo "Findings: ${{ steps.bevor.outputs.n_findings }}"