Quickstart

Add Heyo Code Audit to a workflow that runs on pull_request. The Action needs the full Git history to compare the pull request, permission to create a Check and review comments, and a secret for the selected model provider.

1. 1

   Create a provider secret

   For this OpenAI example, create an OPENAI_API_KEY Actions secret in the repository or organization. The token remains a GitHub secret and is passed to Pi only for the chosen provider.

2. 2

   Add the workflow

   Create .github/workflows/heyo-code-audit.yml:

   yamlCopy

   name: Heyo Code Auditon:  pull_request:    types: [opened, synchronize, reopened]concurrency:  group: heyo-code-audit-${{ github.event.pull_request.number }}  cancel-in-progress: truepermissions:  contents: read  pull-requests: write  checks: writejobs:  audit:    runs-on: ubuntu-latest    timeout-minutes: 60    steps:      - uses: actions/checkout@v7        with:          fetch-depth: 0          persist-credentials: false      - uses: heyo-sh/heyo-code-audit@v1        with:          provider: openai          model: gpt-5.4          auth-type: api-key          auth-token: ${{ secrets.OPENAI_API_KEY }}          github-token: ${{ github.token }}

   Use @v1 for the newest compatible stable release. Pin an immutable release, for example @v1.1.1, if your supply-chain policy requires an exact version.

3. 3

   Open or update a pull request

   Heyo publishes a Check and, by default, an inline review. A failure Check conclusion means at least one verified finding met the configured fail-on threshold, which defaults to high.