GitHub Actions Integration

Automate code reviews on every pull request with Bop and GitHub Actions. This guide covers setup, configuration, and troubleshooting.

Quick Start

Add this workflow to .github/workflows/bop-review.yml:

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21

name: Bop Code Review

on:
  pull_request:
    types: [opened, synchronize, reopened]

permissions:
  contents: read
  pull-requests: write

jobs:
  review:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0  # Full history for accurate diffs

      - uses: delightfulhammers/bop/action@v1
        with:
          anthropic-api-key: ${{ secrets.ANTHROPIC_API_KEY }}

That’s it. One API key, one step, automatic PR reviews.

Action Inputs

Required Secrets

Configure at least one API key in your repository settings (Settings > Secrets and variables > Actions):

The GITHUB_TOKEN is automatically provided by GitHub Actions.

Permissions

The workflow requires these permissions:

1
2
3

permissions:
  contents: read       # Read repository contents
  pull-requests: write # Post review comments

Configuration Options

Using Action Inputs

1
2
3
4
5
6
7

- uses: delightfulhammers/bop/action@v1
  with:
    anthropic-api-key: ${{ secrets.ANTHROPIC_API_KEY }}
    base-ref: develop
    block-threshold: high
    reviewers: security,architecture
    log-level: debug

Using a Config File

Include a bop.yaml or .bop.yaml in your repository root for full configuration:

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18

# bop.yaml
review:
  blockThreshold: high
  alwaysBlockCategories:
    - security

reviewers:
  security:
    provider: anthropic
    weight: 1.5
    persona: |
      You are a security engineer focusing on OWASP Top 10.
    focus:
      - security

defaultReviewers:
  - default
  - security

Block Threshold

The block-threshold input controls when the action fails (blocks the PR):

Skip Triggers

Skip reviews on certain commits by including keywords in the commit message:

• [skip bop]
• [bop skip]
• [skip review]
• [no review]

Example:

1

git commit -m "chore: update deps [skip bop]"

Advanced Workflows

Review Only on Specific Paths

1
2
3
4
5
6
7

on:
  pull_request:
    paths:
      - 'src/**'
      - 'lib/**'
      - '!**/*.md'
      - '!**/*.txt'

Multiple Providers

1
2
3
4
5
6

- uses: delightfulhammers/bop/action@v1
  with:
    anthropic-api-key: ${{ secrets.ANTHROPIC_API_KEY }}
    openai-api-key: ${{ secrets.OPENAI_API_KEY }}
    google-api-key: ${{ secrets.GEMINI_API_KEY }}
    reviewers: security,architecture,performance

Pin a Specific Version

1
2
3
4

- uses: delightfulhammers/bop/action@v1
  with:
    anthropic-api-key: ${{ secrets.ANTHROPIC_API_KEY }}
    version: v0.7.2

Branch Protection Integration

Configure branch protection to require Bop reviews:

1. Go to Settings > Branches > Branch protection rules
2. Click Add rule for your main branch
3. Enable Require status checks to pass before merging
4. Search for and select the Bop workflow job name

Output and Artifacts

Step Summary

Bop writes a summary to the GitHub Actions step summary, visible on the workflow run page.

SARIF Upload

Upload SARIF results to GitHub Code Scanning:

1
2
3
4
5
6
7
8
9

- uses: delightfulhammers/bop/action@v1
  with:
    anthropic-api-key: ${{ secrets.ANTHROPIC_API_KEY }}

- name: Upload SARIF
  uses: github/codeql-action/upload-sarif@v3
  if: always()
  with:
    sarif_file: review-output/*.sarif

Artifact Upload

Save review artifacts for later analysis:

1
2
3
4
5
6
7

- name: Upload Review Artifacts
  uses: actions/upload-artifact@v4
  if: always()
  with:
    name: bop-review
    path: review-output/
    retention-days: 7

Manual Installation (Alternative)

If you prefer not to use the composite action:

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11

- name: Install Bop
  run: |
    curl -LO https://github.com/delightfulhammers/homebrew-tap/releases/latest/download/bop-linux-amd64.tar.gz
    tar xzf bop-linux-amd64.tar.gz
    sudo mv bop bop-mcp /usr/local/bin/

- name: Run Code Review
  env:
    GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
    ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
  run: bop github-action

Platform Integration (Coming Soon)

Bop Pro will add OIDC-based platform authentication for GitHub Actions, enabling:

• Keyless authentication (no API key secrets needed)
• Centralized team configuration
• Usage analytics and budget controls

To prepare for OIDC, add this permission to your workflow:

1
2

permissions:
  id-token: write  # Required for OIDC (Pro feature)

Troubleshooting

“Resource not accessible by integration”

This error means the GITHUB_TOKEN lacks permissions. Ensure your workflow has:

1
2
3

permissions:
  contents: read
  pull-requests: write

“No findings posted”

1. Check that post-findings is true (default)
2. Verify the PR has actual code changes (not just markdown)
3. Check the workflow logs for errors

“Rate limited”

LLM providers have rate limits. Solutions:

1. Reduce the number of reviewers
2. Skip review on certain paths (documentation, etc.)
3. Use faster/cheaper models in your config

Timeout Issues

Large PRs may timeout. Solutions:

1. Increase workflow timeout:

   1 2 3

   jobs: review: timeout-minutes: 30

2. Use faster models in your bop.yaml:

   1 2 3 4

   reviewers: quick: provider: gemini model: gemini-3-flash-preview

3. Split large PRs into smaller ones

Debug Mode

Enable debug logging:

1
2
3
4

- uses: delightfulhammers/bop/action@v1
  with:
    anthropic-api-key: ${{ secrets.ANTHROPIC_API_KEY }}
    log-level: debug

Cost Considerations

Each PR review uses LLM API tokens. Estimated costs vary by:

• PR size: Larger diffs = more tokens
• Number of reviewers: More reviewers = more API calls
• Verification: Enabling verification adds ~30% cost

To manage costs:

1. Use the default single reviewer (cheapest option)
2. Use faster models (Gemini Flash) for custom reviewers
3. Skip verification on non-critical repos
4. Use path filters to skip non-code files

Security Best Practices

1. Use secrets for API keys - Never hardcode API keys
2. Limit permissions - Only grant required permissions
3. Review workflow changes - Require approval for workflow modifications
4. Enable redaction - Prevent secrets in code from reaching LLMs