PatchPilot API Migration

PatchPilot turns provider-authored OpenAPI 3 migration intent into deterministic, syntax-validated JavaScript, TypeScript, and Python client patches. It reports ambiguous changes instead of guessing.

This repository is the minimal public customer-side GitHub Action. It contains no PatchPilot control-plane, billing, OAuth, webhook, deployment, or customer credential code.

GitHub App customers

The PatchPilot GitHub App generates a protected default-branch workflow that pins this Action to a reviewed commit. It supports two paths:

• pull-request analysis receives only signed commit coordinates, checks out the exact head without persisting credentials, and reports API impact;
• provider campaigns download old/new contracts plus a signed manifest from hash-pinned GitHub release assets, verify the customer-pinned Ed25519 key, and apply only deterministic, syntax-valid changes inside the customer's runner.

Provider campaigns fail closed if any asset hash, provider name, signature, expiry, or contract semantics do not match. The provider never supplies the trusted public key; the customer stores it in a protected repository variable.

Direct Action usage

permissions:
  contents: read
  pull-requests: write

steps:
  - uses: actions/checkout@v7
    with:
      fetch-depth: 0
      persist-credentials: false
  - uses: prathamesh-git9/patchpilot-action@v0.18.0
    id: patchpilot
    with:
      spec: api/openapi.yaml
      repo: src
      comment: true
      github_token: ${{ github.token }}
  - if: ${{ always() }}
    uses: actions/upload-artifact@v7
    with:
      name: patchpilot-migration
      path: patchpilot-artifacts
      if-no-files-found: error

For stronger supply-chain control, pin the full commit SHA shown on the release instead of the version tag.

In pull-request mode, spec is the current OpenAPI contract and PatchPilot loads its previous version from the base commit. Use old_spec plus new_spec when both contracts are present in the checkout. Analysis is read-only unless apply: true is explicitly configured.

Outputs

PatchPilot writes:

• audit-report.json with every contract change, affected call site, and validation decision;
• migration.patch, applicable with Git;
• migration-bundle.zip, containing the report, patch, manifest, and migrated source tree.

Missing operationId values and safe changes that cannot be tied to a supported source literal are emitted as coverage gaps, exposed through the coverage_gaps output, and counted as manual review. PatchPilot never treats an unlocated change as proof that the consumer is migrated.

The Action never executes repository source. It performs parser-level syntax validation and removes temporary files after every run.

Trust boundary

Safe automatic migrations require explicit provider intent such as x-patchpilot-renamed-from or x-patchpilot-default. Production users can additionally require a short-lived Ed25519 migration manifest pinned to a provider public key through the require_signed_manifest and provider_public_key_base64 inputs.

Do not run untrusted pull-request code with pull_request_target. Fork pull requests receive read-only GitHub tokens; keep commenting disabled for them.

Security

See SECURITY.md for private vulnerability reporting. Do not include API contracts, source code, tokens, or customer data in public issues.