Design note: why PatchGate trusts the base revision #3
daichunghy
started this conversation in
General
Replies: 0 comments
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Uh oh!
There was an error while loading. Please reload this page.
Design note: PatchGate reads enforceable policy from the trusted base revision, not from the pull request head.
That means a pull request changing
patchgate.ymlcannot use its own proposed policy to relax the requirements applied to that same pull request. The receipt records the base SHA and policy digest, while check and workflow evidence is bound to the tested commit.This boundary creates useful failure states, but it also creates trade-offs: policy changes need a deliberate maintainer handoff, native GitHub controls are not always representable by the current scalar contract, and incomplete permissions must stay visible instead of becoming a green result.
How does your team handle policy changes today? I am especially interested in examples involving branch protection, CODEOWNERS, merge queues, generated files or AI-assisted pull requests. The goal is to compare governance practice, not to claim that PatchGate replaces native GitHub controls.
All reactions