Guides
Private repositories
Give PatchFlow the narrowest repository access that supports PRs, checks, and isolated clones.
GitHub access
Exact permissions depend on whether you use a personal token or GitHub App. Prefer repository-scoped credentials over organization-wide classic tokens.
- Repository contents: read and write for the migration branch
- Pull requests: read and write
- Issues: write for labels and comments
- Checks: read
- Metadata: read
Clone authentication
For local gates, PatchFlow gives Git a temporary askpass program and token file inside the disposable gate directory. The clone URL and command arguments remain secret-free, and the entire directory is removed after the gate.
CI secrets
Important
PatchFlow does not copy CI secrets into the agent prompt. GitHub-hosted checks execute under the repository’s existing workflow permissions.