GitHub Actions

PatchPatrol can run from GitHub Actions as an artifact-first pull request review job. This path reuses the existing bounded diff extraction, provider trust gate, structured validation, and artifact writing pipeline.

It is bounded review, not an agentic coding bot. It does not push branches, fix CI, mutate issues, accept arbitrary @bot commands, or replace the GitLab-first product path.

Workflow

Use this shape for a pull request workflow:

name: PatchPatrol Review

on:
  pull_request:

permissions:
  contents: read

jobs:
  patchpatrol-review:
    runs-on: ubuntu-latest

    steps:
      - name: Checkout pull request
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Install PatchPatrol
        run: python -m pip install patchpatrol

      - name: Run bounded PatchPatrol review
        env:
          AI_REVIEW_PROVIDER: mock
          AI_REVIEW_FEEDBACK_MODE: artifact-only
          AI_REVIEW_OUTPUT_DIR: .ai-review
        run: >
          python -m patchpatrol run
          --mode github-pr
          --provider mock
          --output-dir .ai-review

      - name: Publish PatchPatrol summary
        if: always()
        run: |
          if [ -f .ai-review/ai-review.md ]; then
            cat .ai-review/ai-review.md >> "$GITHUB_STEP_SUMMARY"
          else
            echo "PatchPatrol did not produce ai-review.md." >> "$GITHUB_STEP_SUMMARY"
          fi

      - name: Upload PatchPatrol artifacts
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: patchpatrol-review
          path: |
            .ai-review/ai-review.json
            .ai-review/ai-review.md
            .ai-review/ai-review.html
            .ai-review/gl-code-quality-report.json
          if-no-files-found: warn
          retention-days: 3

Replace mock with your configured provider after endpoint allowlisting and model readiness checks are in place.

Diff Mode

Use --mode github-pr in GitHub Actions pull request jobs. PatchPatrol reads GITHUB_BASE_REF, GITHUB_HEAD_REF, GITHUB_SHA, and the event payload when available, resolves a merge-base diff, then runs the same bounded review pipeline used by other modes.

Set fetch-depth: 0 in actions/checkout so both base and pull request history are available.

Output

The GitHub path writes the canonical PatchPatrol artifacts:

• .ai-review/ai-review.json
• .ai-review/ai-review.md
• .ai-review/ai-review.html
• .ai-review/gl-code-quality-report.json

The workflow publishes ai-review.md to $GITHUB_STEP_SUMMARY, including the repository-context summary rendered from ai-review.json when repository context metadata is available. It uploads the narrow .ai-review/* artifact files with explicit retention.

Set AI_REVIEW_REPOSITORY_CONTEXT=off only when you want to disable repo-local rules, supporting code context, and repository overview for that workflow. It does not override AI_REVIEW_CONTEXT_MODE; if diff+semantic is enabled, semantic diagnostics can still be included in prompt context. Leaving it unset keeps the default on behavior. See Repository-aware rules for the .ai-review.yml rule format and output interpretation.

Privacy

The provider trust boundary is unchanged:

• provider allowlist validation still runs before provider calls,
• secret-like content redaction still runs before provider calls,
• high-confidence private-key or credential patterns still fail closed,
• GitHub job summaries and artifacts follow your repository retention policy.