> ## Documentation Index
> Fetch the complete documentation index at: https://docs.patch.gg/llms.txt
> Use this file to discover all available pages before exploring further.

# Record what a GitHub Actions workflow built

> Send this from the workflow that builds a release's programs, with `permissions: id-token: write`. `token` is the run's GitHub Actions token, asked for with this environment's host as its audience (`patch.gg`, or `staging.patch.gg` on staging). GitHub signs it, and it names the repo, the commit and the workflow, so the review knows the files came from that workflow at that commit. The run has to be on GitHub's own runners, from a workflow file in the same repo at the commit it builds. A release that names that same commit then has those files' `PA-321` dropped (each one's `PA-325` says why), and the review still reads them. A run from any other commit, even an earlier one, doesn't count.



## OpenAPI

````yaml /api-reference/openapi.json post /provenance
openapi: 3.1.0
info:
  title: Patch API
  version: 1.0.0
  description: >-
    The public API behind patch.gg, the desktop app and pch. Changes within v1
    are additive only. Errors are { error: { code, message, details } }; branch
    on code.
servers:
  - url: https://patch.gg/api/v1
security: []
paths:
  /provenance:
    post:
      tags:
        - Releases
      summary: Record what a GitHub Actions workflow built
      description: >-
        Send this from the workflow that builds a release's programs, with
        `permissions: id-token: write`. `token` is the run's GitHub Actions
        token, asked for with this environment's host as its audience
        (`patch.gg`, or `staging.patch.gg` on staging). GitHub signs it, and it
        names the repo, the commit and the workflow, so the review knows the
        files came from that workflow at that commit. The run has to be on
        GitHub's own runners, from a workflow file in the same repo at the
        commit it builds. A release that names that same commit then has those
        files' `PA-321` dropped (each one's `PA-325` says why), and the review
        still reads them. A run from any other commit, even an earlier one,
        doesn't count.
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                token:
                  type: string
                  minLength: 1
                  maxLength: 16384
                files:
                  type: array
                  items:
                    type: object
                    properties:
                      path:
                        type: string
                        minLength: 1
                        maxLength: 1024
                      sha256:
                        type: string
                        pattern: ^[0-9a-fA-F]{64}$
                    required:
                      - path
                      - sha256
                  minItems: 1
                  maxItems: 200
              required:
                - token
                - files
      responses:
        '201':
          description: >-
            Recorded. Sending the same files from the same run again changes
            nothing
          content:
            application/json:
              schema:
                type: object
                properties:
                  recorded:
                    type: integer
                  repository:
                    type: string
                  commit:
                    type: string
                  workflow_ref:
                    type: string
                required:
                  - recorded
                  - repository
                  - commit
                  - workflow_ref
        '400':
          description: Invalid request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '401':
          description: Not signed in
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '403':
          description: Not allowed
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '404':
          description: Not found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '429':
          description: >-
            Too many requests: wait as long as `Retry-After` says
            (`retry_after_s` in `details`), then retry
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '503':
          description: 'GitHub''s signing keys couldn''t be read: retry'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
components:
  schemas:
    Error:
      type: object
      properties:
        error:
          type: object
          properties:
            code:
              type: string
              example: version_exists
            message:
              type: string
            details: {}
          required:
            - code
            - message
      required:
        - error

````

This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.