Put deterministic and AI tenant review in every migration pull request.
BoundaryCI runs inside GitHub Actions, annotates risky Supabase and PostgreSQL migration lines, and keeps deterministic failures separate from optional managed AI observations. Reviewers see one focused tenant-isolation report without managing an AI provider key.
Install one repository-bound workflow
Create the repository in BoundaryCI Cloud, save the one-time token as BOUNDARYCI_CLOUD_TOKEN, and commit the generated workflow. The committed YAML contains only a secret reference; the credential remains in GitHub's encrypted Actions secret store.
yaml- uses: sir-gig/boundaryci@v0.4.0
with:
target: .
fail-on: high
managed-fireworks: "true"
upload: "true"
cloud-token: ${{ secrets.BOUNDARYCI_CLOUD_TOKEN }}Give reviewers evidence at the changed line
Deterministic findings include a rule ID, severity, location, evidence, and remediation. Managed AI returns schema-constrained findings through the same reporting path, labeled so reviewers can distinguish repeatable checks from contextual analysis.
A baseline can acknowledge reviewed existing debt. New non-waived deterministic findings at the configured threshold still fail the job, which allows branch protection to block the regression.
Use managed Fireworks without adding its key to GitHub
Team, Growth, and Enterprise organization managers can authorize managed review once in BoundaryCI. The Fireworks API credential stays server-side, and the existing repository token handles eligibility and review requests.
A manager can disable managed review for the organization or a repository. A workflow can also set managed-fireworks to false, allowing the same scanner to remain deterministic-only.
Keep CI useful when the AI provider is unavailable
Timeouts, rate limits, or invalid model output produce a warning rather than erasing the deterministic result. Managed AI is advisory by default, so a third-party outage does not turn a security check into an unrelated release blocker.
Repeat the setup across repositories
An organization can add multiple repositories from its dashboard. Each repository receives a separate bound token, enablement control, setup guide, and scan history while paid usage is counted at the organization level.
Frequently asked questions
Is this a general AI code-review bot?
No. BoundaryCI is deliberately focused on tenant-isolation risks in ordered Supabase and PostgreSQL SQL migrations. That narrow scope keeps its evidence and recommendations relevant to the customer-data boundary.
Which GitHub secret does the workflow need?
Cloud-connected workflows use BOUNDARYCI_CLOUD_TOKEN, a repository-bound credential shown once during setup. Managed mode does not require customers to add FIREWORKS_API_KEY to GitHub.
What happens if Fireworks is unavailable?
BoundaryCI warns about the managed review failure and continues deterministic scanning and Cloud upload. Deterministic findings can still enforce the configured pull-request gate.