Skip to content

Conversation

@josh-padnick
Copy link
Contributor

@josh-padnick josh-padnick commented Sep 16, 2025

It turns out that #2723 had a bunch of good content that never got merged. In addition, I saw an opportunity to improve Patcher docs for self-hosting. Once we merge this, I think we can officially close the book on the recent Patcher work.

Summary by CodeRabbit

  • Documentation
    • Expanded Concepts: added Terraform support, clarified Patcher ecosystem, two update modes (Legacy upgrade, Ongoing updates), and updated supported integrations.
    • New Guide: “Ongoing Updates” with GitHub Actions workflows, token guidance, scheduling, and enterprise self-hosted scenarios.
    • Updated Guide: “Promotion Workflows” with staged env progression (dev→stage→prod), limitations, setup examples, and event-driven triggers.
    • Overhauled Guide: “Self-hosting” with a prescriptive three-step approach, mirroring binaries, and artifact proxy options.
    • Navigation: added “Ongoing Updates” to the Patcher Guides sidebar.

@vercel
Copy link

vercel bot commented Sep 16, 2025

Deployment failed with the following error:

You must set up Two-Factor Authentication before accessing this team.

View Documentation: https://vercel.com/docs/two-factor-authentication

@coderabbitai
Copy link
Contributor

coderabbitai bot commented Sep 16, 2025

Warning

Rate limit exceeded

@josh-padnick has exceeded the limit for the number of commits or files that can be reviewed per hour. Please wait 2 minutes and 27 seconds before requesting another review.

⌛ How to resolve this issue?

After the wait time has elapsed, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout.

Please see our FAQ for further information.

📥 Commits

Reviewing files that changed from the base of the PR and between 4205ebf and c922b07.

📒 Files selected for processing (4)
  • docs/2.0/docs/patcher/concepts/index.md (1 hunks)
  • docs/2.0/docs/patcher/guides/ongoing-updates.md (1 hunks)
  • docs/2.0/docs/patcher/guides/promotion-workflows.md (9 hunks)
  • docs/2.0/docs/patcher/guides/self-hosting.md (1 hunks)

Walkthrough

Documentation updates expand Patcher concepts and ecosystem terminology, add an “Ongoing Updates” guide, rewrite promotion-workflows and self-hosting guides with prescriptive workflows and artifact-mirroring guidance, and add the new guide to the sidebar. Changes emphasize GitHub/GitHub Enterprise workflows, tokens, and example YAMLs.

Changes

Cohort / File(s) Summary of Changes
Concepts refresh
docs/2.0/docs/patcher/concepts/index.md
Broadens scope to include Terraform; defines the Patcher ecosystem (CLI, Action, tooling); adds “Two update modes”; expands legacy and ongoing flows; simplifies supported integrations to GitHub variants; copy/style edits.
Guides: Ongoing Updates (new)
docs/2.0/docs/patcher/guides/ongoing-updates.md
New guide describing continuous updates via GitHub Actions: two-job pattern (patcher-report, patcher-update), matrix-driven PR creation, token usage (read/update), scheduling/triggers, and GitHub.com vs. Enterprise Self-Hosted examples.
Guides: Promotion Workflows (rewrite)
docs/2.0/docs/patcher/guides/promotion-workflows.md
Rewrites to explain incremental environment promotion (dev→stage→prod), limitations, prerequisites, repository_dispatch triggers, per-environment include_dirs/PR titles, and matrix logic for propagating updates.
Guides: Self-hosting (overhaul)
docs/2.0/docs/patcher/guides/self-hosting.md
Reorients toward a prescriptive self-hosting path: host GH Action, mirror/host patcher & terrapatch binaries, mirror third-party tooling or proxy via artifact managers; adds artifact management section and time-specific notes (as of Sept 2025).
Sidebar update
sidebars/docs.js
Adds “Ongoing Updates” doc entry (2.0/docs/patcher/guides/ongoing-updates) to the Patcher → Guides sidebar list.

Sequence Diagram(s)

sequenceDiagram
  autonumber
  actor Dev as Developer
  participant GH as GitHub Actions
  participant Repo as Repository
  participant PAct as patcher-action
  participant GHAPI as GitHub API

  rect rgb(230,245,255)
  note over GH: Ongoing Updates (report → update)
  Dev->>GH: schedule / workflow_dispatch / repository_dispatch
  GH->>Repo: checkout (fetch-depth: 0)
  GH->>PAct: patcher-report (uses PATCHER_CI_TOKEN/read_token)
  PAct->>Repo: scan modules (OpenTofu/Terraform/Terragrunt)
  PAct-->>GH: spec/report of outdated deps
  GH->>GH: build matrix from report
  loop per dependency
    GH->>PAct: patcher-update (GITHUB_TOKEN or update_token)
    PAct->>Repo: apply changes, create branch
    PAct->>GHAPI: open PR
  end
  end
Loading
sequenceDiagram
  autonumber
  participant Dev as Maintainer
  participant GH as GitHub Actions
  participant Repo as Repository
  participant PAct as patcher-action
  participant GHAPI as GitHub API

  rect rgb(242,255,230)
  note over GH: Promotion workflow — dev → stage → prod
  Dev->>GH: merge dev PR
  GH->>GHAPI: repository_dispatch (dev_updates_merged)
  GH->>Repo: checkout
  GH->>PAct: derive deps (payload or report)
  GH->>GHAPI: open PR targeting stage (include_dirs=stage)
  end

  rect rgb(255,248,230)
  note over GH: After stage merge → trigger prod
  GH->>GHAPI: repository_dispatch (stage_updates_merged)
  GH->>Repo: checkout
  GH->>PAct: derive deps
  GH->>GHAPI: open PR targeting prod (include_dirs=prod)
  end
Loading

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

Possibly related PRs

Suggested reviewers

  • Resonance1584
  • ZachGoldberg

Poem

Pipelines hum and secrets sing,
Reports detect what updates bring.
From dev to stage to prod they roam,
PRs are formed to guide them home.
Mirror, cache, and tokens bright—Patcher keeps infra right. ✨

Pre-merge checks and finishing touches

✅ Passed checks (3 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title Check ✅ Passed The title "Refine patcher docs" succinctly and accurately describes the primary purpose of this changeset, which is to update and improve the Patcher documentation across multiple files. It is concise, focused, and directly related to the changes summarized in the raw_summary and PR objectives (new Ongoing Updates guide, promotion-workflows revisions, and a self-hosting rewrite). Although it does not enumerate every change, it gives a clear, scannable summary appropriate for commit history and review.
Docstring Coverage ✅ Passed No functions found in the changes. Docstring coverage check skipped.

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands and usage tips.

Copy link
Contributor

@coderabbitai coderabbitai bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 0

🧹 Nitpick comments (20)
docs/2.0/docs/patcher/concepts/index.md (3)

29-31: Fix broken/incorrect links

  • Typo in the “interactive mode” link.
  • The “grouping modes” link points to the wrong path.

Apply:

-For legacy upgrades, the Patcher CLI offers an [interactive mode[(guides/update)] where you can browse all modules in the current working directory and below, browse available updates, and upgrade modules one at a time. We've found this approach works well with a modest set of updates, however for significantly out of date repos or files or a large number of files, you may wish to consider alternative approaches.
+For legacy upgrades, the Patcher CLI offers an [interactive mode](../guides/update) where you can browse all modules in the current working directory and below, browse available updates, and upgrade modules one at a time. We've found this approach works well with a modest set of updates; however, for significantly out-of-date repos or a large number of files, you may wish to consider alternative approaches.
 
-For ongoing updates, you can use Patcher in conjunction with our [published GitHub Action](https://github.com/gruntwork-io/patcher-action) to automatically scan your repo's modules and [open pull requests](guides/ongoing-updates) with updated module versions. Opening one pull request for every update would be cumbersome, so Patcher also supports a variety of [grouping modes](/concepts/grouping) that allow you to streamline your workflow.
+For ongoing updates, you can use Patcher with our [published GitHub Action](https://github.com/gruntwork-io/patcher-action) to automatically scan your repo's modules and [open pull requests](../guides/ongoing-updates) with updated module versions. Opening one pull request for every update would be cumbersome, so Patcher also supports a variety of [grouping modes](/2.0/docs/patcher/concepts/grouping) that allow you to streamline your workflow.

11-11: Standardize internal link to IaC Library

Use a site-root path for consistency:

-Patcher supports keeping any set of OpenTofu/Terraform modules up to date, whether they be your inhouse modules, third-party open source modules, or modules from the [Gruntwork IaC Library](library/concepts/overview).
+Patcher supports keeping any set of OpenTofu/Terraform modules up to date, whether they be your in‑house modules, third‑party open‑source modules, or modules from the [Gruntwork IaC Library](/2.0/docs/library/concepts/overview).

35-35: Fix capitalization (IaC) and tighten wording

-For non-breaking changes, for the [Gruntwork Iac Library](library/concepts/overview), Patcher uses a set of pre-generated changelog files to identify the "next safe change," enabling upgrades to automatically bypass "empty" version upgrades where a module is available at a newer version but in fact has had no actual file changes.
+For non‑breaking changes in the [Gruntwork IaC Library](/2.0/docs/library/concepts/overview), Patcher uses a set of pre‑generated changelogs to identify the “next safe change,” enabling upgrades to automatically bypass version bumps where no files actually changed.
docs/2.0/docs/patcher/guides/promotion-workflows.md (6)

14-22: Typos and wording nits

  • intial → initial
  • subsequence → subsequent
  • pull requestions → pull requests
-With promotion workflows, we aim to bridge that gap in a small way. You can now open a pull request that updates OpenTofu/Terraform/Terragrunt code only your intial rollout environment (e.g. dev). Once you merge that pull request, Patcher promotion workflows automatically open a corresponding pull request that updates all the same dependencies for your next rollout environment (e.g. stage). The process continues until you reach prod.
+With promotion workflows, we aim to bridge that gap. You can open a pull request that updates OpenTofu/Terraform/Terragrunt code only in your initial rollout environment (e.g., dev). Once you merge that pull request, Patcher promotion workflows automatically open a corresponding pull request that updates the same dependencies for your next rollout environment (e.g., stage). The process continues until you reach prod.
 
-This way, you can incrementally roll out your changes, but you lessen the pain of doing so because the pull requests for each subsequence environment are created automatically for you.
+This way, you can incrementally roll out your changes, but you lessen the pain because the pull requests for each subsequent environment are created automatically for you.
 
-Of course, you can always just manually update the subsequent pull requestions, so this isn't a blocker, but it's admittedly a limitation.
+Of course, you can always manually update the subsequent pull requests, so this isn't a blocker, but it's admittedly a limitation.

96-101: Pin action versions consistently and grant PR permissions

  • Add pull-requests: write.
  • Use stable tags (avoid @main) and standardize on actions/checkout@v4 and patcher-action@v2.
 permissions:
   contents: write
+  pull-requests: write
@@
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
@@
-      - uses: gruntwork-io/patcher-action@main
+      - uses: gruntwork-io/patcher-action@v2

Also applies to: 135-169


180-259: Stage workflow: avoid @main; keep versions consistent

-      - uses: peter-evans/repository-dispatch@main
+      - uses: peter-evans/repository-dispatch@v2
@@
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v4   # (already v4; keep as-is)
@@
-      - uses: gruntwork-io/patcher-action@main
+      - uses: gruntwork-io/patcher-action@v2

272-327: Prod workflow: avoid @main; keep versions consistent

-      - uses: gruntwork-io/patcher-action@main
+      - uses: gruntwork-io/patcher-action@v2

85-101: Optional: add concurrency to prevent overlapping runs

 name: Update Dev Dependencies
+concurrency:
+  group: patcher-promotions-dev
+  cancel-in-progress: true

95-101: Security note on pull_request_target

Using pull_request_target is powerful but risky with forks. You’ve constrained it to merged PRs; consider also adding a paths filter or using pull_request with minimal permissions if forks are expected.

docs/2.0/docs/patcher/guides/ongoing-updates.md (9)

43-49: Token name mismatch in example

Earlier you instruct storing PATCHER_CI_TOKEN. Use the same name in the sample to avoid confusion.

-    read_token: ${{ secrets.PATCHER_CI_TOKEN_READ_ONLY }} 
+    read_token: ${{ secrets.PATCHER_CI_TOKEN }}

89-92: Replace bare URLs with Markdown links

-1. https://github.com/gruntwork-io/patcher-cli
-2. https://github.com/gruntwork-io/terrapatch-cli
-3. https://github.com/gruntwork-io/patcher-action
+1. [gruntwork-io/patcher-cli](https://github.com/gruntwork-io/patcher-cli)
+2. [gruntwork-io/terrapatch-cli](https://github.com/gruntwork-io/terrapatch-cli)
+3. [gruntwork-io/patcher-action](https://github.com/gruntwork-io/patcher-action)

97-105: Fix typos and invalid link fragment

  • wnat → want
  • Replace the invalid fragment with the actual section anchor.
-Now follow all but the final step in [Step-by-step setup for GitHub.com users](#step-by-step-setup-for-githubcom-users). The final step above is to test that everything is working, but we don't wnat to do that until you've made the modifications below. Once you've completed steps 1 - 3 above, return here, and go to step 3 below.
+Now follow all but the final step in [For GitHub.com users](#for-githubcom-users). The final step above is to test that everything is working, but we don't want to do that until you've made the modifications below. Once you've completed steps 1–3 above, return here and go to step 3 below.

103-108: Fix invalid internal anchor

-Confirm that you updated the GitHub Action workflow as described in [For GitHub Enterprise Self-Hosted Users](#for-github-enterprise-self-hosted-users-1) to work with your specific GitHub Enterprise setup.
+Confirm that you updated the GitHub Action workflow as described in [For GitHub Enterprise Self‑Hosted users](#for-github-enterprise-self-hosted-users) to work with your specific GitHub Enterprise setup.

110-114: Typo

-1. Change the GitHub Actions workflow `runs-on` value to a runner you have internaly, or
+1. Change the GitHub Actions workflow `runs-on` value to a runner you have internally, or

299-301: Invalid admonition type

Use “warning”.

-    :::warn
+    :::warning

261-296: Fix heading levels and list indentation (markdownlint: MD001/MD007/MD026)

  • Change H4 steps to H3 under the H2 “GitHub Personal Access Token Setup”.
  • Remove trailing period in the heading.
  • Normalize list indentation.

Example patch:

-#### 1. Navigate to GitHub Settings
+### 1. Navigate to GitHub Settings
@@
-#### 4. Configure Repository Access
+### 4. Configure Repository Access
@@
-#### 5. Set Required Permissions
+### 5. Set Required Permissions
@@
-#### 6. Generate and Store Token
+### 6. Generate and Store Token
@@
-   - The **patcher-cli repository** (typically `gruntwork-io/patcher-cli` or your custom org)
-   - The **terrapatch-cli repository** (typically `gruntwork-io/terrapatch-cli` or your custom org)
+ - The **patcher-cli repository** (typically `gruntwork-io/patcher-cli` or your custom org)
+ - The **terrapatch-cli repository** (typically `gruntwork-io/terrapatch-cli` or your custom org)

Also applies to: 281-288


307-307: Replace bare URL with a Markdown link

-For more information on the configuration options in our standard GitHub Action, see the README at https://github.com/gruntwork-io/patcher-action.
+For more information on configuration options, see the [patcher-action README](https://github.com/gruntwork-io/patcher-action).

149-184: Optional: add concurrency to the examples to avoid overlapping runs

 name: Patcher Updates
+concurrency:
+  group: patcher-updates
+  cancel-in-progress: true

Also applies to: 212-254

docs/2.0/docs/patcher/guides/self-hosting.md (2)

3-3: Grammar tweak for clarity

-When you run Patcher to automate [ongoing updates](./ongoing-updates.md), Patcher runs in your own action GitHub Actions runners, giving you full control over where and how they run.
+When you run Patcher to automate [ongoing updates](./ongoing-updates.md), it runs on your own GitHub Actions runners, giving you full control over where and how they run.

15-22: Minor wording and consistency

Consider explicitly naming “private” when mentioning binaries and align list numbering:

-These binaries are not publicly available so you must use a GitHub.com token to access these binaries.
+These binaries are private; you must use a GitHub.com token to download them.

The numbered list repeats “1.” (valid Markdown) but you may prefer explicit 1/2/3 for readability in raw files.

📜 Review details

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between 3cd4760 and d216727.

📒 Files selected for processing (5)
  • docs/2.0/docs/patcher/concepts/index.md (1 hunks)
  • docs/2.0/docs/patcher/guides/ongoing-updates.md (1 hunks)
  • docs/2.0/docs/patcher/guides/promotion-workflows.md (2 hunks)
  • docs/2.0/docs/patcher/guides/self-hosting.md (1 hunks)
  • sidebars/docs.js (1 hunks)
🧰 Additional context used
🪛 markdownlint-cli2 (0.17.2)
docs/2.0/docs/patcher/guides/ongoing-updates.md

89-89: Bare URL used

(MD034, no-bare-urls)


90-90: Bare URL used

(MD034, no-bare-urls)


91-91: Bare URL used

(MD034, no-bare-urls)


99-99: Link fragments should be valid

(MD051, link-fragments)


108-108: Trailing punctuation in heading
Punctuation: '.'

(MD026, no-trailing-punctuation)


261-261: Heading levels should only increment by one level at a time
Expected: h3; Actual: h4

(MD001, heading-increment)


262-262: Unordered list indentation
Expected: 0; Actual: 3

(MD007, ul-indent)


265-265: Unordered list indentation
Expected: 0; Actual: 3

(MD007, ul-indent)


266-266: Unordered list indentation
Expected: 0; Actual: 3

(MD007, ul-indent)


269-269: Unordered list indentation
Expected: 0; Actual: 3

(MD007, ul-indent)


270-270: Unordered list indentation
Expected: 0; Actual: 3

(MD007, ul-indent)


271-271: Unordered list indentation
Expected: 0; Actual: 3

(MD007, ul-indent)


272-272: Unordered list indentation
Expected: 2; Actual: 5

(MD007, ul-indent)


273-273: Unordered list indentation
Expected: 2; Actual: 5

(MD007, ul-indent)


281-281: Unordered list indentation
Expected: 0; Actual: 3

(MD007, ul-indent)


282-282: Unordered list indentation
Expected: 0; Actual: 3

(MD007, ul-indent)


286-286: Unordered list indentation
Expected: 0; Actual: 3

(MD007, ul-indent)


287-287: Unordered list indentation
Expected: 0; Actual: 3

(MD007, ul-indent)


288-288: Unordered list indentation
Expected: 0; Actual: 3

(MD007, ul-indent)


295-295: Unordered list indentation
Expected: 0; Actual: 3

(MD007, ul-indent)


296-296: Unordered list indentation
Expected: 0; Actual: 3

(MD007, ul-indent)


297-297: Unordered list indentation
Expected: 0; Actual: 3

(MD007, ul-indent)


299-299: Code block style
Expected: fenced; Actual: indented

(MD046, code-block-style)


300-300: Code block style
Expected: fenced; Actual: indented

(MD046, code-block-style)


307-307: Bare URL used

(MD034, no-bare-urls)

⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (1)
  • GitHub Check: Validate generated content
🔇 Additional comments (2)
sidebars/docs.js (1)

574-578: New "Ongoing Updates" sidebar entry looks good

Entry and id path match the added doc. Please confirm Docusaurus builds and the link resolves locally/CI.

docs/2.0/docs/patcher/guides/ongoing-updates.md (1)

149-184: Version pinning consistency (avoid @main across docs)

Ensure all examples use stable tags:

  • actions/checkout@v4
  • gruntwork-io/patcher-action@v2
  • peter-evans/repository-dispatch@v2 (if shown)

Would you like me to sweep the repo to normalize action versions?

Also applies to: 212-254

Copy link
Contributor

@coderabbitai coderabbitai bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1

🧹 Nitpick comments (9)
docs/2.0/docs/patcher/guides/ongoing-updates.md (6)

95-103: Fix broken anchor and typo (“wnat”), and clarify step reference.

The fragment #step-by-step-setup-for-githubcom-users doesn’t exist; link to the “For GitHub.com users” section, fix the typo, and tweak wording.

-Now follow all but the final step in [Step-by-step setup for GitHub.com users](#step-by-step-setup-for-githubcom-users). The final step above is to test that everything is working, but we don't wnat to do that until you've made the modifications below. Once you've completed steps 1 - 3 above, return here, and go to step 3 below.
+Now follow all but the final step in [For GitHub.com users](#for-githubcom-users). The final step above is to test that everything is working, but we don't want to do that until you've made the modifications below. Once you've completed steps 1–3 above, return here and continue with step 3 below.

Also update Line 101’s fragment:

-... [For GitHub Enterprise Self-Hosted Users](#for-github-enterprise-self-hosted-users-1) ...
+... [For GitHub Enterprise Self-Hosted users](#for-github-enterprise-self-hosted-users) ...

106-112: Nit: remove trailing punctuation in heading and fix “internaly” typo.

-#### 4. Confirm that your runners will work with the `patcher-action`.
+#### 4. Confirm that your runners will work with the `patcher-action`
...
-1. Change the GitHub Actions workflow `runs-on` value to a runner you have internaly, or
+1. Change the GitHub Actions workflow `runs-on` value to a runner you have internally, or

87-90: Avoid bare URLs: convert to Markdown links for readability/linting.

-1. https://github.com/gruntwork-io/patcher-cli
-2. https://github.com/gruntwork-io/terrapatch-cli
-3. https://github.com/gruntwork-io/patcher-action
+1. [gruntwork-io/patcher-cli](https://github.com/gruntwork-io/patcher-cli)
+2. [gruntwork-io/terrapatch-cli](https://github.com/gruntwork-io/terrapatch-cli)
+3. [gruntwork-io/patcher-action](https://github.com/gruntwork-io/patcher-action)

188-191: Clarify “uses” replacement instruction (current example is confusing).

Say explicitly to replace gruntwork-io/patcher-action@v2 with your internal org’s action.

-2. Presumably, you're self-hosting the [gruntwork-io/patcher-action](https://github.com/gruntwork-io/patcher-action). If that's the case, update any instances of the `uses` value to match your local GitHub Enterprise repo. For example, replace `my-enterprise-org/patcher-action@v2` with your actual org name and the name you chose for the `patcher-action` repo.
+2. Presumably, you're self-hosting the [gruntwork-io/patcher-action](https://github.com/gruntwork-io/patcher-action). If that's the case, replace any `uses: gruntwork-io/patcher-action@v2` with `uses: <your-org>/patcher-action@v2` throughout the workflow.

259-296: Fix heading levels and list indentation in PAT section to satisfy markdownlint.

Promote H4s to H3s under the H2 and normalize list indentation.

-#### 1. Navigate to GitHub Settings
+### 1. Navigate to GitHub Settings
-   - Click your profile picture → **Settings** → **Developer settings** → **Personal access tokens** → **Fine-grained tokens**
+ - Click your profile picture → **Settings** → **Developer settings** → **Personal access tokens** → **Fine-grained tokens**
 
-#### 2. Create New Token
+### 2. Create New Token
-   - Click **Generate new token**
-   - Select **Fine-grained personal access token**
+ - Click **Generate new token**
+ - Select **Fine-grained personal access token**
 
-#### 3. Configure Token Settings
+### 3. Configure Token Settings
-   - **Token name**: Choose a descriptive name (e.g., `PATCHER_CI_TOKEN`)
-   - **Expiration**: Set to **90 days** or shorter or longer, depending on your internal security policy.
-   - **Resource owner**: Select the GitHub organization that holds the patcher-cli and terrapatch-cli tools.
+ - **Token name**: Choose a descriptive name (e.g., `PATCHER_CI_TOKEN`)
+ - **Expiration**: Set to **90 days** or as required by your internal security policy.
+ - **Resource owner**: Select the GitHub organization that holds the patcher-cli and terrapatch-cli tools.
-     - If you are accessing these via GitHub.com, the organization is `gruntwork-io`.
-     - If you are accessing these via self-hosted GitHub Enterprise, the organization is whatever GitHub organization has the `patcher-cli` and `terrapatch-cli` repos.
+   - If you are accessing these via GitHub.com, the organization is `gruntwork-io`.
+   - If you are accessing these via self-hosted GitHub Enterprise, the organization is whatever GitHub organization has the `patcher-cli` and `terrapatch-cli` repos.
 
-     :::warning
-     It's easy to not select the right organization! Be sure to select the right GitHub org -- not your username -- that actually holds the repos you're looking to access.
-     :::
+:::warning
+It's easy to not select the right organization! Be sure to select the right GitHub org — not your username — that actually holds the repos you're looking to access.
+:::
 
-#### 4. Configure Repository Access
+### 4. Configure Repository Access
-   Configure access to the following repositories:
-   - The **patcher-cli repository** (typically `gruntwork-io/patcher-cli` or your custom org)
-   - The **terrapatch-cli repository** (typically `gruntwork-io/terrapatch-cli` or your custom org)
+Configure access to the following repositories:
+ - The **patcher-cli repository** (typically `gruntwork-io/patcher-cli` or your custom org)
+ - The **terrapatch-cli repository** (typically `gruntwork-io/terrapatch-cli` or your custom org)
 
-#### 5. Set Required Permissions
+### 5. Set Required Permissions
-   Under "Permissions", configure these **Repository permissions**:
-   - **Contents**: **Read** access
-   - **Metadata**: **Read** access
-   - **Actions**: **Read** access (for downloading releases)
+Under "Permissions", configure these **Repository permissions**:
+ - **Contents**: **Read** access
+ - **Metadata**: **Read** access
+ - **Actions**: **Read** access (for downloading releases)
 
-   :::info
-   The GitHub Action will also need the permission to open pull requests, however it will get that from the `GITHUB_TOKEN` that is automatically generated for each GitHub Actions workflow run. Therefore this token can be read-only.
-   :::
+:::info
+The GitHub Action will also need the permission to open pull requests; it gets that from the `GITHUB_TOKEN` automatically generated for each workflow run. Therefore this token can be read‑only.
+:::
 
-#### 6. Generate and Store Token
+### 6. Generate and Store Token
-   - Click **Generate token**
-   - **Copy the token immediately** (you won't be able to see it again)
-   - Store it as a GitHub Actions secret named `PATCHER_CI_TOKEN` in the repository where the workflow runs.
+ - Click **Generate token**
+ - **Copy the token immediately** (you won't be able to see it again)
+ - Store it as a GitHub Actions secret named `PATCHER_CI_TOKEN` in the repository where the workflow runs.
 
-    :::warn
-    Keep your token secure and never commit it to your repository. Always store it as a GitHub secret.
-    :::
+:::warning
+Keep your token secure and never commit it to your repository. Always store it as a GitHub secret.
+:::

303-306: Avoid bare URL; make it a Markdown link.

-For more information on the configuration options in our standard GitHub Action, see the README at https://github.com/gruntwork-io/patcher-action.
+For more information on the configuration options in our standard GitHub Action, see the [patcher-action README](https://github.com/gruntwork-io/patcher-action).
docs/2.0/docs/patcher/guides/self-hosting.md (3)

3-6: Clarify opening sentence; avoid “only in self-hosted mode” confusion and fix wording.

Currently it reads oddly (“action GitHub Actions runners”) and can be misread given many users run on GitHub‑hosted runners.

-When you run Patcher to automate [ongoing updates](./ongoing-updates.md), Patcher runs in your own action GitHub Actions runners, giving you full control over where and how they run. In that sense, Patcher works _only_ in self-hosted mode!
+When you run Patcher to automate [ongoing updates](./ongoing-updates.md), it executes within your chosen GitHub Actions runners (GitHub‑hosted or self‑hosted), giving you control over where and how jobs run. This guide covers how to fully self‑host all Patcher components.

15-16: Optional: clarify token requirement phrasing.

Make it explicit that access requires a token whether downloading from Gruntwork’s org or your mirrored internal org.

-These binaries are not publicly available so you must use a GitHub.com token to access these binaries.
+These binaries are not publicly available, so downloads require an authenticated token—either to Gruntwork’s org on GitHub.com or to your mirrored internal org.

31-34: Cross-link the enterprise action visibility requirement (helps avoid 404 on internal action).

Add a note reminding users to allow org‑wide access to the internal patcher-action (consistent with the Ongoing Updates guide).

 See [ongoing updates](./ongoing-updates.md) for detailed instructions on how to configure GitHub Enterprise self-hosted.
+
+:::info
+If you self-host the `patcher-action`, ensure it’s accessible from other repositories in your organization (Settings → Actions → General → Access). See “Make your internal GitHub Action accessible” in the Ongoing Updates guide.
+:::
📜 Review details

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between d216727 and 4205ebf.

📒 Files selected for processing (3)
  • docs/2.0/docs/patcher/concepts/index.md (1 hunks)
  • docs/2.0/docs/patcher/guides/ongoing-updates.md (1 hunks)
  • docs/2.0/docs/patcher/guides/self-hosting.md (1 hunks)
🚧 Files skipped from review as they are similar to previous changes (1)
  • docs/2.0/docs/patcher/concepts/index.md
🧰 Additional context used
🪛 markdownlint-cli2 (0.17.2)
docs/2.0/docs/patcher/guides/ongoing-updates.md

87-87: Bare URL used

(MD034, no-bare-urls)


88-88: Bare URL used

(MD034, no-bare-urls)


89-89: Bare URL used

(MD034, no-bare-urls)


97-97: Link fragments should be valid

(MD051, link-fragments)


106-106: Trailing punctuation in heading
Punctuation: '.'

(MD026, no-trailing-punctuation)


259-259: Heading levels should only increment by one level at a time
Expected: h3; Actual: h4

(MD001, heading-increment)


260-260: Unordered list indentation
Expected: 0; Actual: 3

(MD007, ul-indent)


263-263: Unordered list indentation
Expected: 0; Actual: 3

(MD007, ul-indent)


264-264: Unordered list indentation
Expected: 0; Actual: 3

(MD007, ul-indent)


267-267: Unordered list indentation
Expected: 0; Actual: 3

(MD007, ul-indent)


268-268: Unordered list indentation
Expected: 0; Actual: 3

(MD007, ul-indent)


269-269: Unordered list indentation
Expected: 0; Actual: 3

(MD007, ul-indent)


270-270: Unordered list indentation
Expected: 2; Actual: 5

(MD007, ul-indent)


271-271: Unordered list indentation
Expected: 2; Actual: 5

(MD007, ul-indent)


279-279: Unordered list indentation
Expected: 0; Actual: 3

(MD007, ul-indent)


280-280: Unordered list indentation
Expected: 0; Actual: 3

(MD007, ul-indent)


284-284: Unordered list indentation
Expected: 0; Actual: 3

(MD007, ul-indent)


285-285: Unordered list indentation
Expected: 0; Actual: 3

(MD007, ul-indent)


286-286: Unordered list indentation
Expected: 0; Actual: 3

(MD007, ul-indent)


293-293: Unordered list indentation
Expected: 0; Actual: 3

(MD007, ul-indent)


294-294: Unordered list indentation
Expected: 0; Actual: 3

(MD007, ul-indent)


295-295: Unordered list indentation
Expected: 0; Actual: 3

(MD007, ul-indent)


297-297: Code block style
Expected: fenced; Actual: indented

(MD046, code-block-style)


298-298: Code block style
Expected: fenced; Actual: indented

(MD046, code-block-style)


305-305: Bare URL used

(MD034, no-bare-urls)

⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (2)
  • GitHub Check: Pull Request has non-contributor approval
  • GitHub Check: Validate generated content

@vercel
Copy link

vercel bot commented Sep 16, 2025

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Preview Comments Updated (UTC)
docs Ready Ready Preview Comment Sep 16, 2025 0:52am

@josh-padnick
Copy link
Contributor Author

@odgrim Would you mind taking a quick pass through this and approving if it looks good? I'd love to merge by today if possible.

Copy link
Contributor

@odgrim odgrim left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

approved pending linter/spell checker fix

@josh-padnick josh-padnick merged commit 328019b into main Sep 16, 2025
6 of 7 checks passed
@josh-padnick
Copy link
Contributor Author

FYI, fixed the build issues in 08d691d and 22c045d.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants