Preserve template author identity in generated updates

[nahtnam]

Summary

• preserve the raw author of the template commit on each generated Patchworks update commit
• record the automation separately as committer: GitHub's documented github-actions[bot] identity for github.com GITHUB_TOKEN runs, and an explicit or neutral automation identity for custom-token and GHES runs
• validate template and caller-supplied identities before working-tree mutation, with focused runtime and real-Git regression coverage
• document the attribution policy and its Vercel limits

Evidence and decision

The portfolio audit found that all ten affected consumer PR heads were authored and committed as Patchworks <bot@patchworks.dev>, with no GitHub account associated to either header. Nine have an explicit Vercel author-mapping failure; gptcoupons#1 only reports the broader Deployment was blocked, so its exact cause remains unconfirmed.

All ten corresponding template commits preserve a GitHub-mapped source author. Patchworks applies one first-parent template commit per normal update, so preserving that author follows Git's cherry-pick attribution model without claiming that a scheduled-workflow actor wrote the generated change. The credential still determines who pushes the branch and opens the PR; the committer header records the automation that materialized it.

This addresses the observed unowned author email, but does not guarantee a Vercel preview. Vercel still checks the commit author's login connection and project/team access, plus fork and verified-commit policies. See Vercel's Git deployment rules, its commit metadata troubleshooting guide, GitHub's author/committer distinction, and the official github-actions[bot] recipe.

Verification

• Action runtime: 68 tests passed
• Focused CLI update suites: 28 tests passed across 3 files
• Disposable local Git fixture: exact template author and automation committer headers verified
• Root and docs TypeScript checks passed
• Targeted Oxlint passed
• action.yml parsed as a composite action
• git diff --check passed
• Independent adversarial diff review found no blocker

Lifecycle and scope

This is a draft PR only. It does not modify consumer PRs, PR #12, or PR #13; change GitHub/Vercel identity, permissions, or settings; trigger a Vercel deployment manually; or publish a Patchworks release. Any checks or Vercel deployment created automatically for this PR are preview-only, not production.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
patchworks	Ready	Preview	Aug 12, 2026 12:00pm