CircleCI

When a check fails, PatchWave reads the job logs to find out why. It gets GitHub Actions logs through the GitHub app. CircleCI has no app or OAuth integration PatchWave can install, so you give PatchWave an API token.

Without a token, analysis still runs, but PatchWave can’t see why CircleCI jobs failed.

Choose a token type

	Org-wide token	Project tokens
Setup	Once per organization	Once per repository
CircleCI token	Read-only personal access token (PAT)	Project API token, Read Only
Where it goes	PatchWave workspace default secret	PatchWave repository secret

The org-wide token is simpler because you set it up once.

Option 1: one org-wide token

1. In CircleCI, go to User Settings → Personal API Tokens and create a personal access token with access level Read.
2. In PatchWave, go to Settings → Secrets.
3. Under Workspace default, add a secret named CIRCLE_TOKEN and paste the token.

Option 2: one token per project

1. In CircleCI, open the project and go to Project Settings → API Permissions.
2. Create a token with the Read Only scope.
3. In PatchWave, go to Settings → Secrets.
4. Under Repositories, add a secret named CIRCLECI_PROJECT_TOKEN to the matching repository and paste the token.
5. Repeat for each repository.

How PatchWave uses the token

• PatchWave only reads from CircleCI: recent jobs for the pull request’s commit and failed step output.
• The token is encrypted in AWS Systems Manager Parameter Store. You can’t view it after you save it.
• CircleCI personal tokens expire within a year. Replace the secret before the token expires.

See Security and privacy for more on how we handle secrets.