feat: execute signed provider migration campaigns

Author: prathamesh-git9

README.md

@@ -6,7 +6,12 @@ This repository is the minimal public customer-side GitHub Action. It contains n
 
 ## GitHub App customers
 
-The PatchPilot GitHub App generates a protected default-branch workflow that pins this Action to a reviewed commit. The workflow receives only signed pull-request coordinates, checks out the exact head commit without persisting credentials, analyzes it inside the customer's own GitHub runner, comments on the pull request, and uploads the migration evidence.
+The PatchPilot GitHub App generates a protected default-branch workflow that pins this Action to a reviewed commit. It supports two paths:
+
+- pull-request analysis receives only signed commit coordinates, checks out the exact head without persisting credentials, and reports API impact;
+- provider campaigns download old/new contracts plus a signed manifest from hash-pinned GitHub release assets, verify the customer-pinned Ed25519 key, and apply only deterministic, syntax-valid changes inside the customer's runner.
+
+Provider campaigns fail closed if any asset hash, provider name, signature, expiry, or contract semantics do not match. The provider never supplies the trusted public key; the customer stores it in a protected repository variable.
 
 ## Direct Action usage
 
@@ -20,7 +25,7 @@ steps:
     with:
       fetch-depth: 0
       persist-credentials: false
-  - uses: prathamesh-git9/patchpilot-action@v0.17.0
+  - uses: prathamesh-git9/patchpilot-action@v0.18.0
     id: patchpilot
     with:
       spec: api/openapi.yaml

action.yml

@@ -61,6 +61,27 @@ inputs:
     description: Fail unless the contract migration has a valid, unexpired provider signature pinned by provider_public_key_base64.
     required: false
     default: 'false'
+  old_spec_url:
+    description: Hash-pinned previous contract URL for provider campaign mode; GitHub asset hosts only.
+    required: false
+  old_spec_sha256:
+    description: SHA-256 digest for old_spec_url.
+    required: false
+  new_spec_url:
+    description: Hash-pinned new contract URL for provider campaign mode; GitHub asset hosts only.
+    required: false
+  new_spec_sha256:
+    description: SHA-256 digest for new_spec_url.
+    required: false
+  manifest_url:
+    description: Hash-pinned provider manifest URL for provider campaign mode; GitHub asset hosts only.
+    required: false
+  manifest_sha256:
+    description: SHA-256 digest for manifest_url.
+    required: false
+  provider:
+    description: Provider name expected in the signed campaign manifest.
+    required: false
 
 outputs:
   breaking_changes: