v0.1.0-beta.1 — first public beta

PatchGate v0.1.0-beta.1 is the first public beta of a review-readiness gate for pull requests. It ships one deterministic evaluator behind both a CLI and a GitHub Action.

What it does

PatchGate reads trusted base-commit policy (patchgate.yml, CODEOWNERS, branch protection/Rulesets subset), pull-request metadata, changed paths, ownership requirements and SHA-bound check evidence, then emits a versioned ContributionReceipt with one final status: ready_for_review, blocked, human_review_required, evidence_missing or policy_ambiguous.

It is not an AI-authorship detector, a code-correctness oracle, or a replacement for GitHub Rulesets or maintainer judgment.

Supported surface (GitHub.com)

• pull_request events, head or merge target (merge-group membership is explicitly unsupported and reported non-ready);
• read-only metadata: repository identity, PR identity, changed paths, reviews, linked issues (GraphQL), check runs and workflow runs bound to the tested SHA;
• base-commit policy reading only — a PR can never relax the rules that govern it;
• optional idempotent Check Run (create-check-run: true).

Required permissions

The adapter is read-only: repository metadata, pull requests, contents, checks, actions read, collaborator visibility, and (for teams) members read. Creating a Check Run additionally needs checks: write. Fail-closed behavior: a 404 is treated as unknown unless confirmed absence is explicitly supplied, a 403 is an insufficient-capability diagnostic, and unsupported Ruleset semantics remain non-ready rather than guessed.

Known limitations

• merge-group membership is not representable and reports non-ready;
• unsupported Ruleset semantics fail closed;
• human_review_required means a declared human gate is unsatisfied — it is not proof of human review;
• the receipt is digest-bound and reproducible, not cryptographically signed;
• shadow evidence is pending: this beta ships with a documented no-go decision on shadow installations rather than pilot results (see docs/releases/beta-release-and-rollback.md).

Consumer reference (shadow, non-blocking)

- name: PatchGate beta shadow gate
  uses: daichunghy/patchgate@301c7001e34fa4eee705b2a8a83e8e2a65797049
  with:
    fail-on: never
    create-check-run: true
    github-token: ${{ github.token }}

Pin to this full commit SHA; do not treat a branch reference as immutable.

Verification

Fresh-checkout npm run verify at the tagged commit: lint, typecheck, budget/pin/event/doc-link/community/dossier checks, audit (0 vulnerabilities), 138 tests (94 unit, 14 security, 25 GitHub integration, 5 CLI process), clean-room action bundle, consumer fixture and release-candidate checks all pass; public CI (Node 20/22, ubuntu/macos), CodeQL and Dependabot runs pass on the same commit. Beta status: this is a pre-release for shadow evaluation; it is not production-declared, not externally piloted, and blocks merges only where a maintainer configures it as a required status check with an expected-source setting.

Correction (2026-08-22): the consumer reference below was originally published as daichunghy/patchgate/action@<SHA>, which resolves to a nonexistent subdirectory and fails at workflow setup. Use the root form shown now. A critical input-parsing fix (runner exports INPUT_GITHUB-TOKEN-style dashed names) ships in v0.1.0-beta.2 — prefer beta.2 for any shadow evaluation.