Quickstart

Add Heyo Code Audit to a workflow that runs on pull_request. The Action needs the full Git history to compare the pull request, permission to create a Check and review comments, and a secret for the selected model provider.

1. 1

   Create a provider secret

   For this OpenAI example, create an OPENAI_API_KEY Actions secret in the repository or organization. The token remains a GitHub secret and is passed to Pi only for the chosen provider.

2. 2

   Add the workflow

   Create .github/workflows/heyo-code-audit.yml:

   yamlCopy

   name: Heyo Code Audit
   
   on:
     pull_request:
       types: [opened, synchronize, reopened]
   
   concurrency:
     group: heyo-code-audit-${{ github.event.pull_request.number }}
     cancel-in-progress: true
   
   permissions:
     contents: read
     pull-requests: write
     checks: write
   
   jobs:
     audit:
       runs-on: ubuntu-latest
       timeout-minutes: 60
       steps:
         - uses: actions/checkout@v7
           with:
             fetch-depth: 0
             persist-credentials: false
         - uses: heyo-sh/heyo-code-audit@v1
           with:
             provider: openai
             model: gpt-5.4
             auth-type: api-key
             auth-token: ${{ secrets.OPENAI_API_KEY }}
             github-token: ${{ github.token }}

   Use @v1 for the newest compatible stable release. Pin an immutable release, for example @v1.1.1, if your supply-chain policy requires an exact version.

3. 3

   Open or update a pull request

   Heyo publishes a Check and, by default, an inline review. A failure Check conclusion means at least one verified finding met the configured fail-on threshold, which defaults to high.