patchbot v0.2.1

Highlights

• Tiered fix loop: deterministic version bump + lockfile regeneration first; a coding agent only when the bump fails, briefed with the failure itself. Every PR is re-scanned before it opens.
• Four agent backends: claude / codex CLIs, api (Anthropic SDK, no Node), command (bring your own agent), and managed (Claude Managed Agents: the agent runs off your CI runner and your GitHub token never enters the sandbox).
• Scheduled deployments: patchbot managed deploy runs scan + fix on a cron schedule with no CI at all.
• GitHub Action: SARIF upload to the Security tab, optional auto-fix PRs, model and managed-* inputs.
• Bring your own threat feed (any OSV-format file or URL) and bring your own scanner (trivy, grype, osv-scanner, or any tool that emits SARIF).

Usage

- uses: PrismorSec/patchbot@v0
  with:
    fail-on: high

See the README for auto-fix and Managed Agents setups.