/protect

Protect your repo.

Nothing happens to a repository until its owner opts in. Choose one path. You can revoke access at any time by uninstalling the App.

<?php$page = ["permissions" => 4, least privilege,"writes" => patch-agent/* only,"default_branch" => never touched,"revoke" => uninstall the app,];

01 You install the App
02 .patchbot narrows scope
03 Agent scans pinned PHP
04 PR on patch-agent/*
05 Your CI runs
06 You merge

Path 01

Install the GitHub App

Select the repositories you want covered. Installation is the authorization.

Install on GitHub →

Path 02

Add a .patchbot file

Narrow what the agent may do in a repository where the App is installed: severities, patch types, PR settings and verification requirements.

Requested permissions^{[github-app-permissions]}

MetadatareadList repositories you selected during installation.
ContentswriteRead Dockerfile, compose, CI and composer files; create a patch-agent/* branch and commit to it. Never the default branch.
Pull requestswriteOpen the pull request and update its description.
ChecksreadRead CI results on the PR branch.

Not requested: administration, secrets, workflows, actions, members, issues, deployments, environments.

Policy editor

.patchbot

Validation

VALID POLICY

{
  "version": 1,
  "enabled": true,
  "severity": [
    "critical",
    "high"
  ],
  "patches": {
    "dependencies": true,
    "containers": true,
    "ci": true
  },
  "pull_requests": {
    "enabled": true,
    "draft": false
  },
  "verification": {
    "require_ci": true,
    "require_human_review": false
  }
}

Unknown keys are rejected. The schema has no field for commands: tests run in your own CI, never from this file.

Install the GitHub App

Add a .patchbot file

Requested permissions[github-app-permissions]

Policy editor

Requested permissions^{[github-app-permissions]}