Patchlit
Get started
Early access, on GitHub

The right moment to turn red into green.

Patchlit fixes the dependency updates and bug reports that break your build, and lets your own CI prove each fix worked. You decide what it may touch, how much it may change, and when it must ask.

Install on GitHubSee how it works

3 fixed pull requests a month free. No card. Works with public and private repositories.

Bump express and @types/express
replay
  1. CI failed
    Express 5 removed req.param(name). 14 tests fail.
  2. Patchlit reads the failure
    Logs, the version diff and 3 files the logs name. Nothing else.
  3. Push 1
    Replaces req.param(name) with req.params.name where it was used.
  4. CI still red
    The wildcard route syntax changed too.
  5. Push 2
    Renames the wildcard route to the new syntax.
  6. CI passed on Patchlit's commit
    Audit of what landed: clean. No test, lockfile or CI file touched.
src/routes/orders.js
router.get('/orders/:id', (req, res) => {
- const id = req.param('id');
+ const id = req.params.id;
res.json(await orders.get(id));
-router.get('/files/*', serve);
+router.get('/files/*path', serve);
redyour CI decides
A replay of one fix on our own test repository. An example, not a promise: you read every fix before it merges.
  • Your CI is the judge
  • Nothing merges itself
  • Checked before the push, audited after
  • Protected paths stay untouched
  • Secrets in CI? It asks first
  • Small fixes, hard limits
  • It says no, out loud
  • A model never grades its own work
Early access. We publish a green rate once there are enough real runs behind it to mean something, and not before.
What counts as green
How it works

From red to green, in four moves.

Dependency updates are where it starts. The same loop handles bug reports, with one extra safeguard.

The whole loop, in detail

  1. A bump breaks your CI

    Renovate or Dependabot opens an update and your checks go red. Both bots stop there. This is where Patchlit starts.

  2. Patchlit reads the failure

    The failing job logs, the version diff, and the handful of files the logs point at. Not your whole repository.

  3. It pushes the smallest fix

    A commit on the same branch, so you review one PR, not two. It never edits your tests, lockfiles, CI config or dependencies.

  4. Your CI decides

    Green on the commit Patchlit pushed counts. Anything else is another try, up to your limit, then a clear hand-back to a person.

Your rules

You set how Patchlit behaves. Try it.

Every control is per repository, saved in your dashboard, and enforced in the code that decides what Patchlit does. Move these and the same sample fix is accepted or handed back.

Your rules
Protected paths

Real defaults and ceilings. In your dashboard these are saved per repository and enforced before every push, and again on what landed.

A sample fix, 4 files
Handed back to a person
  • src/routes/orders.js2 lines
  • src/billing/invoice.jsprotected
  • db/migrations/004_orders.sql1 lines
  • src/lib/format.js40 lines
Stopped, and said so on the PR: it touches a protected path (invoice.js).
All the controls
One way in

Dependency updates

A Renovate or Dependabot bump goes red. Patchlit adapts your code to the new version on the same branch and waits for your CI. One PR to review, not two.

  1. Red bump
  2. Small fix
  3. Your CI
Another, when you switch it on

Bug reports, reproduce first

You label an issue. Patchlit writes one failing test and opens a PR holding only that. Your CI must confirm it fails, then Patchlit waits for you to read that one test and approve it. Only after that does it write the fix.

  1. Failing test
  2. You approve
  3. The fix
  4. Your CI
Built to be checked

Trust it the way you trust a stranger’s pull request.

It passes your tests, so it earns a review, not a merge. That is the whole design.

01

Your CI is the judge

A fix counts only when your own checks go green on the exact commit Patchlit pushed. A model never scores its own work.

02

Checked twice

Every fix is vetted before it is pushed and audited again from what actually landed in git.

03

Nothing merges itself

Patchlit never merges. A person reads the diff, and “merged as is” is tracked as its own number.

Patchlit will not
  • Delete a module to turn CI green
  • Stub out a failing test
  • Edit your test config
  • Touch lockfiles or CI files
  • Swap a provider to dodge an error
  • Merge anything itself
  • Push when CI uses secrets, unasked
  • Grow a fix past your limits
Read the security model
Platforms

GitHub now. The rest are planned.

Your rules are platform-neutral, so they will carry over as more are added.

GitHub
Available
GitLab
Planned
Bitbucket
Planned
Azure DevOps
Planned

Stop letting red bump PRs rot.

Install it on one repository that already runs Renovate or Dependabot. The next breaking bump gets a fix attempt, within the rules you set.

Install on GitHubSee pricing