PatchPilot API Migration

PatchPilot turns provider-authored OpenAPI 3 migration intent into deterministic, syntax-validated JavaScript, TypeScript, and Python client patches. It reports ambiguous changes instead of guessing.

This repository is the minimal public customer-side GitHub Action. It contains no PatchPilot control-plane, billing, OAuth, webhook, deployment, or customer credential code.

GitHub App customers

The PatchPilot GitHub App generates a protected default-branch workflow that pins this Action to a reviewed commit. The workflow receives only signed pull-request coordinates, checks out the exact head commit without persisting credentials, analyzes it inside the customer's own GitHub runner, comments on the pull request, and uploads the migration evidence.

Direct Action usage

permissions:
  contents: read
  pull-requests: write

steps:
  - uses: actions/checkout@v7
    with:
      fetch-depth: 0
      persist-credentials: false
  - uses: prathamesh-git9/patchpilot-action@v0.14.0
    id: patchpilot
    with:
      spec: api/openapi.yaml
      repo: src
      comment: true
      github_token: ${{ github.token }}
  - if: ${{ always() }}
    uses: actions/upload-artifact@v7
    with:
      name: patchpilot-migration
      path: patchpilot-artifacts
      if-no-files-found: error

For stronger supply-chain control, pin the full commit SHA shown on the release instead of the version tag.

In pull-request mode, spec is the current OpenAPI contract and PatchPilot loads its previous version from the base commit. Use old_spec plus new_spec when both contracts are present in the checkout. Analysis is read-only unless apply: true is explicitly configured.

Outputs

PatchPilot writes:

• audit-report.json with every contract change, affected call site, and validation decision;
• migration.patch, applicable with Git;
• migration-bundle.zip, containing the report, patch, manifest, and migrated source tree.

The Action never executes repository source. It performs parser-level syntax validation and removes temporary files after every run.

Trust boundary

Safe automatic migrations require explicit provider intent such as x-patchpilot-renamed-from or x-patchpilot-default. Production users can additionally require a short-lived Ed25519 migration manifest pinned to a provider public key through the require_signed_manifest and provider_public_key_base64 inputs.

Do not run untrusted pull-request code with pull_request_target. Fork pull requests receive read-only GitHub tokens; keep commenting disabled for them.

Security

See SECURITY.md for private vulnerability reporting. Do not include API contracts, source code, tokens, or customer data in public issues.