willow-bot
GitHub App webhook receiver + orchestrator-feeding steward for the Willow fleet. Propose-only: the App may comment and deposit draft CI outcomes; it cannot commit.
Install: pip install willow-bot
Docs: INSTALL.md · docs/MOVE-STAY-BORROW.md
willow-bot # webhook (uvicorn)
willow-bot-steward tick # PR watch one-shot
willow-bot-steward status # read-only surface: version, tick, inbox depth, cursors
willow-bot-steward status --brief # one line per section
willow-bot-steward app-grant # does the App have the permissions and events the code needs?
willow-bot-steward redeliver # ask GitHub to resend webhook deliveries the bot never got (also every tick)
willow-bot-steward ci-backfill # fill CI for open PRs with none recorded, from GitHub's check runs (also every tick)
willow-bot-steward contributions --days 30 # who contributed: outsiders, first-timers, per repo
willow-bot-steward contributions --backfill # fill the ledger from GitHub history (core_repos, 90 days)
willow-bot-steward venvs [--plan] # D2: which venvs are inside the bot, and how to recreate the rest inside (prints, runs nothing)
willow-bot-steward current [--json] # each checkout against its origin, and each copy against its source (copies.json): reads only
willow-bot-steward keep-current # one tick of the loop's keep-current step: pull triggers for checkouts left behind, human_required for restarts owed, stale installs and copies behind
willow-bot-steward pypi [--json] # every venv's packages against PyPI: vulnerable, yanked, pinned on purpose, patch, minor, major (7-day cooldown): reads only
willow-bot-contribute [--user LOGIN] # anyone: your projects, what waits on you, openings (your GITHUB_TOKEN or gh login, never the App's)
willow-bot-steward heartbeat # curated willow-mcp tools when WILLOW_BOT_MCP=1
willow-bot-deterministic serve # host loopback runner (Unix socket for Kart)
willow-bot-deterministic client --fixtures /path/to/S-growth-*.json dir
Home: willow-memory/willow-bot
Anyone can run it as their own GitHub App. Who you are, which orgs and repos it
looks after, and where the voice speaks live in your install's operator profile
($WILLOW_HOME/willow-bot/operator.json; see deploy/operator.example.json), never
in code. With no profile it discovers what it can and otherwise does nothing.
Match actors by user.type == Bot, never login.
1 maintainer
Metadata
1 maintainer
Release files for willow-bot 1.29.3
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Source distribution (sdist)
| File | Size | Uploaded | Provenance | Actions |
|---|---|---|---|---|
| willow_bot-1.29.3.tar.gz | 1.3 MB | With provenance | Details for willow_bot-1.29.3.tar.gz |
Built distribution (wheel)
| File | Interpreter | ABI | Platform | Actions Reset |
|---|---|---|---|---|
| willow_bot-1.29.3-py3-none-any.whl | Python 3 | none | any | Details for willow_bot-1.29.3-py3-none-any.whl |
Total release size: 1.6 MB
Release files / willow_bot-1.29.3.tar.gz
| Download URL | willow_bot-1.29.3.tar.gz |
|---|---|
| Size | 1.3 MB |
| Tags | Source |
|
SHA-256 checksum How to use checksums |
0071418c4ec86ef2efb769461170ed31ab786380856deffe38fac88e58193fd9
|
|
BLAKE2b-256 checksum How to use checksums |
0eb219ab85efdb44323dbb6471f4b26abf1addab97da4fe032af72e51b8b17c0
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/7.0.0 CPython/3.13.16
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Oct 31, 2026.
Transparency logRelease files / willow_bot-1.29.3-py3-none-any.whl
| Download URL | willow_bot-1.29.3-py3-none-any.whl |
|---|---|
| Size | 272.1 kB |
| Tags | Python 3 |
|
SHA-256 checksum How to use checksums |
261d2218553c077895630e4a64694205d84aa655d40702cd452ee85de7ae9f86
|
|
BLAKE2b-256 checksum How to use checksums |
e2aa1ffccbb639d27b03cdada4f98579918662e8f0eaee56a4895fd0494712c1
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/7.0.0 CPython/3.13.16
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Oct 31, 2026.
Transparency logSecurity for willow-bot 1.29.3
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
Full provenance
All 2 files in this release have been uploaded with provenance metadata.
Attestation for willow_bot-1.29.3.tar.gz
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Oct 31, 2026.
Transparency logA note on package security
PyPI is a repository for distributing packages, not a service for auditing them. While third-party security researchers and our staff do their best to detect and remove malicious packages, PyPI cannot guarantee the quality, security or suitability of any given package.
To learn more about protecting yourself from malicious actors, visit our package security documentation.
