v0.3.0: The Count finds his server from a checkout, resolves mise tools through mise, and ships a container image

The Count can now find his own server from a checkout, asks the pinned mise for every tool's versions, and publishes a container image. Two changes need your attention: mise tool branch names and the docs URLs.

Added

• A checkout finds the Count's server (#15, @sweepies). patchula lookup, run and tui in a checkout, with no repository named, look for the server's marker in the newest 500 open issues and PRs. If they find one, they ask once whether to run there and remember the answer for that repository in ~/.config/patchula/repositories.json. Use --no-server to run locally for one command. Without a terminal there is no request and no prompt, so CI is unaffected.

  The server writes its URL into each PR and dependency dashboard it manages. Set publicUrl if the App's webhook goes through a relay such as smee.io, which has no /webhook path to derive the URL from. Set advertise = false to keep the URL out of what the Count writes. Turning advertising on or off edits each open PR once.

• A read-only repository API (#16, @sweepies). The server exposes GET /api/v1/repositories and GET /api/v1/repositories/{owner}/{repo} for a dashboard. It needs no sign-in, allows any origin, and shows only public repositories. It reports each repository's last run, its dependencies and updates, its open PRs (with headSha, for a merge through GitHub's own API) and up to 20 PRs the Count merged. Set publicApi = false to turn it off.

• A container image (#19, @sweepies). Each release publishes ghcr.io/sweepies/count-patchula for linux/amd64 and linux/arm64, tagged with the version without the v and latest (not for prereleases). The image starts patchula serve as user 10001 and includes mise. See the container image guide.

• Setup prompt on the getting started page (#12, @sweepies). The page opens with a prompt you can paste into a coding agent to set up the Count for a repository.

• Packslip tools in the short form work (#17, @sweepies). packslip:owner/repo is now accepted as well as packslip:github.com/owner/repo. Other hosts are still refused.

Changed

• Every mise tool is looked up with mise ls-remote (#18, @sweepies). The Count runs the pinned mise in a sandbox, so any backend mise lists works, including packslip monorepo paths, go:, gem:, dotnet:, spm:, conda: and http:. Node's LTS line comes from mise ls-remote node lts. Listings are cached for an hour per tool and token scope, and a manual retry asks mise again.
• Prereleases follow the Count's prerelease rules. mise's listing now includes prereleases. A pin on a stable version is not offered a prerelease, and a pin on a prerelease is offered later ones. Previously a prerelease pin was not offered any later version.
• Names are refused before mise starts when they use asdf: or vfox: (plugin backends), a leading -, bracketed tool options, or a tool@version selector such as prettier@3. The @ sign is allowed only to open an npm scope, as in npm:@types/node.
• A cargo: tool pinned to a Git URL reports a warning, since mise lists only HEAD for it and there is no release to move to.
• A failed or empty Node lts listing no longer fails the whole catalog. Only a dependency on the LTS channel reports the missing evidence.
• Docs site is built from main alone (#13, @sweepies). The /next/ and /vX.Y.x/ paths and the version picker are gone. The site always shows the main branch's docs at the root.

Breaking Changes

• mise tool branch names use the tool name (#18). For example, patchula/jq-1.x replaces patchula/jqlang-jq-1.x. If you match update branches by name in branch protection rules, rulesets or automation, update those patterns.
• mise must be on PATH for lookups as well as for lockfile tools. Install it as the installation guide describes before upgrading.
• Versioned docs links no longer resolve. Links to /next/ or /vX.Y.x/ pages on the docs site need the root path instead.

Full Changelog: v0.2.0...v0.3.0

v0.2.0: Remote runs with --server, and patchula serve replaces --server

The Count can now be summoned to a server from your own shell, and his server has a command of its own. The server's flags moved, so update any start commands before you upgrade.

Added

• Remote runs with --server (#10, @sweepies). patchula lookup, run and tui accept --server <url> (or PATCHULA_SERVER) and run on a Count Patchula server, using its GitHub App's credentials and caches. You need no token or toolchain of your own.

  patchula auth login --server <server-url>
  patchula run --server <server-url> acme/app
  patchula auth logout --server <server-url>

  The first run signs you in through GitHub's device flow. The token is stored per server in ~/.config/patchula/servers.json (mode 0600) and refreshed as it expires. auth logout forgets the local token only; revoke the App authorization under GitHub's Applications settings if you want it gone.

  Requirements:

  • You need push access to every repository. Read access is not enough.
  • The repositories must share one App installation.
  • The server accepts only this App's user tokens.
  • Operators must tick Enable Device Flow in the App settings.
  • Plain HTTP is allowed only to loopback addresses.

  The server applies each repository's own patchula.pkl. These flags are refused with --server: --local, --config, --config-dir, --all-repos, --allow-lockfile-pending and --recheck.

  The device flow and the permission checks have been tested only against fakes, not against live GitHub.

Changed

• Docs site moved to Starlight (#11, @sweepies). The site is versioned from release tags: the root is the latest release, /next/ is the development branch, and each older minor line is under /vX.Y.x/. Page URLs now end in a slash, for example /getting-started/.

Breaking Changes

The server is patchula serve, and its flags have moved (#10, @sweepies). patchula --server is no longer recognised. Use the serve subcommand, and rename --server-cache to --cache:

# 0.1.3
patchula --server --settings server.pkl --server-cache cache.sqlite

# 0.2.0
patchula serve --settings server.pkl --cache cache.sqlite

--settings, --listen, --cache, --app-id, --private-key-file, --webhook-secret-file and --shutdown-timeout-secs now belong to serve. The PATCHULA_* environment variables, including PATCHULA_SERVER_CACHE, are unchanged. --recheck is still a global flag. Hosting start commands, such as Railway's, need serve.

Full Changelog: v0.1.3...v0.2.0

v0.1.3: Reference data auto-merges, and schedule windows fire once per turn

The Count keeps his appointments: a window time is due on the first run after it, however often he is woken. Reference data such as CA root bundles is now fast-tracked, and the server no longer sweeps when it starts.

Added

• Reference data is fast-tracked (#8, @sweepies). CA root bundles, time zone data and the public suffix list now carry a reference-data kind on top of their own. A built-in first rule gives those updates no release-age wait, no schedule window, their own PR, and auto-merge once checks and required reviews pass. Covered packages include certifi, tzdata, pytz, publicsuffixlist, webpki-roots, webpki-root-certs, chrono-tz, psl, golang.org/x/crypto/x509roots/fallback, tldts, tzinfo-data, public_suffix and composer/ca-bundle. Open-PR and per-hour limits still apply to these PRs.

  To keep a reference data update on manual review, add a rule after the built-in one:

  rules {
    new Rule {
      select { kinds { "reference-data" } }
      apply { merge = false; waitHours = 24 }
    }
  }

  Assigning your own rules Listing replaces the whole list, including the built-in rule.

Breaking Changes

Schedule windows are due on the first run after each time (#9, @sweepies). A window's cron times are no longer matched only against the current minute. Each time an expression names is due on the first run after it, so "0 3 * * *" means once a day, after 03:00, whether the Count runs hourly, daily, from a webhook or from CI. Expressions that cover a range, such as every minute of a morning, still allow every run in that range. The Count records each repository's last successful run in its cache; dry runs and failed runs do not count.

Check these when you upgrade:

• The first run for a repository, before a run has been recorded, proposes only if the current minute matches a window time. This includes the first run after upgrading.
• Lockfile maintenance uses the same rule. Its default Monday 00:00 to 04:00 UTC window is now a real window.
• Weekdays use standard numbering: 0 or 7 is Sunday, 1 is Monday. The old parser counted 1 as Sunday, so "* 0-6 * * 1" ran on Sundays. The same numbering applies to the server's sweepCron.

The server does no sweep at startup (617c6cc). The first sweep is the next time the sweepCron schedule names. Queued work survives restarts, and the readiness probe still checks installations straight away. If you relied on a restart to trigger a sweep, wait for the schedule or use a webhook. The Railway guide now says to leave Serverless off, because the server's 30-second App probe keeps it awake anyway.

Fixed

• Auto-merge no longer waits for a window. The fallback merge checked windows, which the configuration guide never said it did, so a PR could wait a day after its checks passed. Windows decide when updates are proposed; release age still gates merging (#9, @sweepies).

Full Changelog: v0.1.2...v0.1.3

v0.1.2: Config moves to patchula.pkl at the repository root; local runs reuse your mise tools

The Count now finds his invitation at the root of each repository, and local runs borrow tool versions you already have in mise instead of downloading them.

Breaking Changes

Repository config moves to patchula.pkl at the root. .github/patchula.pkl is no longer read, so a repository that only has that file is skipped. Move the file to the root and update its amends line, since the schema module has also been renamed from Patchula.pkl to PatchulaConfig.pkl (#5, @sweepies):

// 0.1.1: .github/patchula.pkl
amends "../Patchula.pkl"

// 0.1.2: patchula.pkl at the repository root
amends "PatchulaConfig.pkl"

prs { dashboard = true }

If you vendored the schema, regenerate it under its new name with patchula config schema > PatchulaConfig.pkl. A vendored PatchulaConfig.pkl is the copy that gets evaluated, so keep it in step with the Count you run. A leftover Patchula.pkl is not used. Organization modules and --config-dir policy files that amend Patchula.pkl need the same change.

Added

• Local runs (patchula run, lookup, tui and tools install) hard-link a matching tool version from your own mise install into the Count's tool store, rather than downloading it. Node, Go, Bun, aube, Yarn, uv and Terraform are covered. On a fresh store, patchula tools install took 35 s with borrowing against 68 s without, on a fast connection. The source is MISE_DATA_DIR, or ~/.local/share/mise, and it must be on the same filesystem as the store. Python, Ruby, PHP and .NET are always installed fresh. The server never borrows. Pruning only removes the store's own links, never your installs (#6, @sweepies).

Changed

• The GitHub Action resolves version: latest through GitHub releases rather than the public versions mirror, which can lag behind a new release (#5, @sweepies).

Fixed

• A fresh tool store no longer logs "unproven tool install was not removed" for versions that are not installed yet (#6, @sweepies).

Full Changelog: v0.1.1...v0.1.2

v0.1.1: A GitHub Action for scheduled runs, and commands default to the current checkout

The Count can now run from a GitHub Action, and without a repository argument he works on the checkout you are in rather than every repository your token can reach.

Added

• A GitHub Action, sweepies/count-patchula, that installs patchula with mise, keeps the cache between scheduled runs, and runs patchula run. It takes token, repositories, all-repos, dry-run, version and args inputs. Pinning the action to a release tag runs that matching version. (#4)

  - uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0
    id: app
    with:
      client-id: ${{ vars.PATCHULA_CLIENT_ID }}
      private-key: ${{ secrets.PATCHULA_APP_PRIVATE_KEY }}
  - uses: sweepies/count-patchula@v0.1.1
    with:
      token: ${{ steps.app.outputs.token }}

  The guide covers a single repository and an organization-wide runner that uses --config-dir. Use a GitHub App token, not GITHUB_TOKEN, so the Count's pull requests trigger your checks.

• A patchula skill for coding agents, shipped in the packslip manifest and at skills/patchula. It covers configuring, validating and running the Count.

Breaking Changes

lookup, run and tui no longer process every accessible repository when you give no repository argument. They now use the GitHub repository from the origin remote of the current directory, or its only remote. If the directory is not a checkout of a github.com repository, the command exits with status 2.

To keep the old behavior, pass --all-repos:

# 0.1.0: every repository the token can reach
patchula run

# 0.1.1: the repository in the current checkout
patchula run

# 0.1.1: every repository the token can reach, as before
patchula run --all-repos

Update scripts and CI jobs that relied on the no-argument form to add --all-repos. Naming repositories explicitly (owner/repo) works as before.

Full Changelog: v0.1.0...v0.1.1

v0.1.0: First tagged release with signed prebuilt binaries for Linux and macOS

The Count rises for the first time under a version number. v0.1.0 is the first tagged release, and it ships prebuilt, signed binaries so you no longer need a Rust toolchain to try him.

Added

• Prebuilt patchula binaries for Linux (static musl builds, x86_64 and arm64) and macOS (Apple silicon and Intel). Each archive includes the man page and bash, zsh and fish completions. (#2)

• Install with mise. Every release carries a packslip manifest signed by the release workflow, so mise checks each download against it:

  mise use -g packslip:github.com/sweepies/count-patchula

  Pin a version with packslip:github.com/sweepies/count-patchula@0.1.0. Building from source with cargo install --git https://github.com/sweepies/count-patchula --locked patchula-cli still works and needs Rust 1.99 or newer and a C linker.

• Dependency updates across many ecosystems, including Cargo, npm, pnpm, Yarn, Python (uv and Poetry), Go, Maven, Gradle, NuGet, Bundler, Composer, Terraform, Helm charts, pre-commit hooks, devcontainers and toolchain files. Lockfiles are regenerated with the real tools.

• One pull request per update, with batching of reviewed updates into a single PR from a checkbox, a maintained dependency dashboard, and native auto-merge.

• Policy in .github/patchula.pkl, validated by patchula config check.

• A patchula tui terminal UI for browsing and applying updates.

• GitHub App server mode that accepts authenticated webhook triggers.

New Contributors

• @sweepies made their first contribution in #1

Full Changelog: https://github.com/sweepies/count-patchula/commits/v0.1.0