Safe GitHub Patch Committer

A small reusable GitHub write component extracted from AutoPentest Studio.

It accepts an already-reviewed patch and commits it to a new isolated branch while preventing stale or accidental writes.

Core safeguards

The component:

1. accepts only standard GitHub HTTPS repository URLs
2. resolves the current base-branch commit
3. refuses to use the base branch as the patch branch
4. creates an isolated branch
5. validates an existing branch instead of blindly accepting GitHub HTTP 422
6. reads the current target file from GitHub
7. verifies the file's SHA-256 against the version used when the patch was generated
8. refuses to commit if the source changed
9. writes the patch through GitHub's Contents API
10. returns the created branch and commit URL

This component does not decide whether a patch is safe or approved. Human approval should happen before calling it.

Requirements

• Python 3.10+
• requests
• a GitHub token with access to the target repository and permission to write repository contents

Install:

pip install -r requirements.txt

Usage

from safe_github_patch_committer import (
    PatchProposal,
    commit_patch_to_isolated_branch,
    sha256_text,
)
original_source = open("app.py", "r", encoding="utf-8").read()
proposal = PatchProposal(
title="Security: parameterize SQL query",
target_file="app.py",
patched_content="...reviewed complete replacement file...",
expected_sha256=sha256_text(original_source),
)
result = commit_patch_to_isolated_branch(
repository_url="https://github.com/example/example-app.git",
base_branch="main",
token="YOUR_FINE_GRAINED_TOKEN",
proposal=proposal,
branch_name="security/fix-sqli-001",
)
print(result["branch"])
print(result["commit_url"])

Why SHA-256 is checked

A patch may be reviewed against version A of a file. If another developer changes that file to version B before the patch is committed, blindly applying the old replacement could overwrite new code or create an unsafe result.

The expected SHA-256 binds the approved patch to the exact source version that was reviewed.

Branch behavior

This gig intentionally does not commit directly to the base branch.

If the requested patch branch already exists, it is only reusable when it still points to the same untouched base commit. Otherwise the function fails and requires a new branch name.

Limitations

• Designed for UTF-8 text files.
• Uses GitHub's Contents API.
• The caller is responsible for human review/approval before invocation.
• The caller is responsible for pull-request review, CI, deployment, and runtime re-testing.

Origin

Built during the hackathon as AutoPentest Studio's human-approved GitHub remediation commit capability, then extracted as a standalone reusable code gig.

Dependencies / disclosure

• GitHub REST API
• requests
• No AutoPentest Studio database, scanner, authentication, or UI code is included.

License

Recommended marketplace/repository license: MIT.