certora/Auto Prover CI

Run Auto Prover security audits on pull request changes and create GitHub issues for findings

Trust Signals

name	description	required	default
api-key	Auto Prover API key	yes	—
context	Comma-separated glob patterns for files to analyze (e.g., "contracts/*/.sol,src/*/.sol")	yes	—
github-token	GitHub token for creating issues and PR comments. Also passed to Auto Prover for private repo access.	yes	${{ github.token }}
api-base-url	Auto Prover API base URL	no	https://zeus.certora.com
audit-type	Audit type. Simple: "diff" or "full". Per-branch: "main:full,dev:diff" (fallback: diff).	no	diff
scope	Comma-separated scope patterns for full audits (subset of context to focus on). Only used when audit-type is "full".	no	—
preprompt	Custom instructions for the audit	no	—
use-memory	Use Auto Prover repo memory for full audits. Set to false to skip previously accepted assumptions.	no	true
max-iterations	DeepDive iterations (4-10)	no	6
skip-submodules	Skip git submodule loading	no	false
poll-interval	Seconds between status polls	no	60
timeout	Maximum minutes to wait for audit completion	no	120
create-issues	Create GitHub issues for findings	no	true
issue-severities	Comma-separated severities to create issues for (e.g., "HIGH,MEDIUM")	no	HIGH,MEDIUM
comment-on-pr	Post a summary comment on the PR	no	true
fail-on	Fail the action if findings of these severities exist (e.g., "HIGH" or "HIGH,MEDIUM"). Empty means never fail.	no	""
labels	Comma-separated labels to add to created issues	no	auto-prover,security

name	description
job-id	Auto Prover audit job ID
status	Final audit status (succeeded, failed, cancelled)
highs-count	Number of HIGH severity findings
mediums-count	Number of MEDIUM severity findings
lows-count	Number of LOW severity findings
infos-count	Number of INFO severity findings
issues-created	Comma-separated list of created issue URLs