GitHub Action

chainvet/chainvet-action is a composite GitHub Action that scans Solidity contracts in CI and surfaces findings in GitHub code scanning (the repo's Security tab) via SARIF. It's a thin wrapper over the chainvet-ci binary.

Drop-in workflow

Create .github/workflows/chainvet.yml:

name: Chainvet
on: [push, pull_request]

permissions:
  security-events: write   # required to upload SARIF
  contents: read

jobs:
  chainvet:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v5
      - uses: chainvet/chainvet-action@v1
        with:
          path: contracts
          mode: hybrid
          fail-on-severity: high

Inputs

The gate trips only when a finding clears both fail-on-severity and fail-on-confidence — the same gating semantics as chainvet-ci.

How it works

1. Installs chainvet-ci by downloading the prebuilt binary for the selected release (seconds); falls back to a from-source build (Z3 + Rust) if no prebuilt matches — e.g. a branch name in version, or a non-x86_64-Linux runner.
2. Runs the scan and writes SARIF.
3. Uploads the SARIF even when the scan fails the threshold, so findings always land in the Security tab.
4. Exits non-zero if fail-on-severity was met — gating the PR after upload.

Review findings under Security → Code scanning on the repo.