Private repositories

GitHub access

PatchFlow does not need repository contents write access; the migration agent pushes the branch through its own GitHub integration. The PatchFlow GitHub App uses Checks read, Contents read, Issues write, and Pull requests write on repositories you select. Local CLI evaluation may use a short-lived personal access token for Check Runs — keep it scoped and never treat it as the hosted SaaS boundary.

• Repository contents: read for PatchFlow diff inspection and optional clones
• Pull requests: read and write
• Issues: write for labels and comments
• Checks: read
• Metadata: read

Clone authentication

For local gates, PatchFlow gives Git a temporary askpass program and token file inside the disposable gate directory. The clone URL and command arguments remain secret-free, and the entire directory is removed after the gate.

CI secrets