feat: rebrand the checkup as a PatchWave on-ramp and remove report analytics by blimmer · Pull Request #76 · contextbridge/patchwave-analysis

blimmer · 2026-10-15T16:56:38Z

Summary

Turns the checkup into an on-ramp to PatchWave. The CLI is renamed "PatchWave Dependency Checkup" and links to PatchWave when a scan finishes. The report adopts the PatchWave brand and 16-bit look, leads with the org's open updates and unpatched vulnerabilities, and sends its CTAs to the trial sign-up with UTM tags. The report no longer sends any analytics; the CLI's usage events and crash reports are unchanged and are now disclosed in the welcome banner.

Please review the storybook here: https://6a1476f6e70f669b161a85a3-upyttirqru.chromatic.com/?path=/story/report-app--default

This ships as 1.0.0.

Review focus

Removing report analytics entirely (last commit). Report clicks are now measured only through the UTM tags in src/report/web/reportCtaUrls.ts, so patchwave.ai's analytics needs to record utm_source, utm_medium and utm_content. This also fixes a leak on main, where the report's PostHog events carried the local file:// path of the report and session replay recorded unmasked text.
The banner's telemetry notice: is one line about DO_NOT_TRACK=1 enough disclosure for opt-out CLI telemetry?

Commits

92d3f0e — fix: name the CLI "PatchWave Dependency Checkup" and drop report-sharing copy
4b4f7d1 — feat: remove analytics from the report and disclose CLI telemetry in the banner
9c8aeaf — feat: describe PatchWave in the banner and link to it when the scan finishes
82a99c1 — docs: point the README at PatchWave and correct its guidance
b03ea70 — feat: bring PatchWave's brand and pixel components into the report
2726e9c — feat: lead the report with the problem and send its CTAs to the trial sign-up

Release-As: 1.0.0

…ing copy User-facing text now calls the CLI "PatchWave Dependency Checkup" (or "the checkup"), so "PatchWave" only means the GitHub app. Copy that still promised report sharing, removed in 0.7.1, now says the report stays on the user's machine.

…the banner The report no longer bundles posthog-js or sends any events, so it makes no network requests. The CLI's own usage events and crash reports are unchanged, and the welcome banner now says it sends them and how to turn them off.

…inishes The welcome banner says what the scan measures and what PatchWave is, and the CLI ends with a link to patchwave.ai. The link's UTM tags live only in the terminal hyperlink, so the visible text stays clean. URLs the CLI and report share now come from src/urls.ts.

blimmer · 2026-10-15T17:01:58Z

-      </Button>
+          <div className="mt-2 flex flex-wrap items-center gap-x-6 gap-y-4 no-print">
+            <Button asChild variant="sun" cursor>
+              <a data-testid={verdictTestIds.primaryCta} href={`#${automatedStorySectionId}`}>


The hero is only about the problem now. I want the takeaway to be "this is a big problem for you", so Patch and the trial buttons wait until the PatchWave section. This button just scrolls down to it.

blimmer · 2026-10-15T17:01:58Z

+
+      <div className="mt-6">
+        <Card>
+          <CostReceipt />


I moved the editable calculation out of the hero and into this section, since it already explains the number. The hero links here with "How we calculated this".

This undoes part of #17, which put the assumptions in the hero.

blimmer · 2026-10-15T17:01:58Z


 export const costReceiptCopy = {
-  observedLabel: 'PRs merged',
+  observedLabel: 'PRs merged or reviewed',


This number is merges plus reviews (humanMergeCount + humanReviewCount), so the "PRs merged" label on main was wrong.

blimmer · 2026-10-15T17:01:59Z

+        <Sprite sprite="patchHead" scale={3} />
+      </PixelTile>
+      <div className="grid gap-1">
+        <p className="text-foreground m-0 text-2xl font-bold">Meet Patch.</p>


Patch shows up here, with the solution, instead of surfing in the hero. The surfboard felt forced, so this introduces him the way patchwave.ai's "Meet Patch" section does.

blimmer · 2026-10-15T17:01:59Z

@@ -0,0 +1,21 @@
+# Copied from the PatchWave repo


Everything in pixel/ and the pixel primitives is copied from the website package, so you can skim it. This file lists each source and what I changed or dropped.

blimmer · 2026-10-15T17:01:59Z

+  high: 'text-severity-high',
+};
+
+/** A labelled figure, one cell of a StatGrid. */


The report had five label-plus-number components, each styled a little differently. They're all Stat now. This also gets rid of the black "Annualized" box, which was the only pure-black thing on the page after the rebrand.

blimmer · 2026-10-15T17:01:59Z

@@ -0,0 +1,20 @@
+export const PATCHWAVE_URL = 'https://patchwave.ai/';


All the URLs the CLI and report link to live here now, and withUtm is the one place we build tracking tags.

blimmer · 2026-10-15T17:03:44Z

@@ -1,5 +1,5 @@
 export function welcomeBannerTitle(): string {
-  return 'patchwave-analysis';
+  return 'PatchWave Dependency Checkup';


Thoughts on this name?

blimmer · 2026-10-15T17:04:21Z

@@ -0,0 +1,19 @@
+export const PATCHWAVE_URL = 'https://patchwave.ai/';


Putting all URLs into a constants file

blimmer · 2026-10-15T17:17:25Z


 function UnitToggle() {
  const { unit, setUnit } = useDisplayUnit();
-  const analytics = useAnalytics();


We can't easily use UserCentrics on something served from localhost, so I think the easiest thing to do is just remove the web analytics for now.

jcarver989

Ship it. Fun seeing all the brand stuff come in here too, and I think it's totally ok to copypasta it for now.

Adds a report screenshot and a "What is PatchWave?" section, explains who sees the full CVE section, corrects the $0 troubleshooting entry, and brings the source trees in AGENTS.md and CONTRIBUTING.md up to date.

Copies the brand colors, Radio Canada and Geist Mono, Patch's head, the wordmark, and the website's pixel engine and components from the PatchWave repo. src/report/web/brand/README.md lists each source and what changed locally. The report is light-only now, like patchwave.ai, so the Storybook theme switcher and dark stories are gone.

… sign-up The hero now states the org's problem: hours spent on Dependabot PRs, open updates, and unpatched vulnerabilities with critical alerts flagged. Its button scrolls to the PatchWave section, which introduces Patch and holds the first trial link. The cost calculation moves into the section that explains it. Sections use the pixel components, and label-plus-number figures share one Stat primitive. The trial buttons go to app.patchwave.ai/join with UTM tags per placement and use the site's trial copy. The header logo and "See how it works" link go to patchwave.ai.

🤖 I have created a release *beep* *boop* --- ## [1.0.0](v0.7.1...v1.0.0) (2026-10-15) ### Features * rebrand the checkup as a PatchWave on-ramp and remove report analytics ([#76](#76)) ([4c09944](4c09944)) --- This PR was generated with [Release Please](https://github.com/googleapis/release-please). See [documentation](https://github.com/googleapis/release-please#release-please). Co-authored-by: contextbridge-pr-automation[bot] <259134118+contextbridge-pr-automation[bot]@users.noreply.github.com>

blimmer requested a review from jcarver989 as a code owner October 15, 2026 16:56

blimmer added 3 commits October 15, 2026 11:10

blimmer force-pushed the outreach/report-conversion branch 2 times, most recently from 46b971b to 198079a Compare October 15, 2026 17:14

blimmer commented Oct 15, 2026

View reviewed changes

jcarver989 approved these changes Oct 15, 2026

View reviewed changes

blimmer added 3 commits October 15, 2026 11:30

docs: point the README at PatchWave and correct its guidance

82a99c1

Adds a report screenshot and a "What is PatchWave?" section, explains who sees the full CVE section, corrects the $0 troubleshooting entry, and brings the source trees in AGENTS.md and CONTRIBUTING.md up to date.

blimmer force-pushed the outreach/report-conversion branch from 198079a to 2726e9c Compare October 15, 2026 17:32

Merge branch 'main' into outreach/report-conversion

d09a4dd

blimmer merged commit 4c09944 into main Oct 15, 2026
9 checks passed

blimmer deleted the outreach/report-conversion branch October 15, 2026 17:38

contextbridge-pr-automation Bot mentioned this pull request Oct 15, 2026

chore(main): release 1.0.0 #80

Merged

Navigation Menu

Repository navigation

feat: rebrand the checkup as a PatchWave on-ramp and remove report analytics - #76

feat: rebrand the checkup as a PatchWave on-ramp and remove report analytics#76
blimmer merged 7 commits into
mainfrom
outreach/report-conversion

blimmer commented Oct 15, 2026 •

edited

Loading

Uh oh!

blimmer Oct 15, 2026

Uh oh!

blimmer Oct 15, 2026

Uh oh!

blimmer Oct 15, 2026

Uh oh!

blimmer Oct 15, 2026

Uh oh!

blimmer Oct 15, 2026

Uh oh!

blimmer Oct 15, 2026

Uh oh!

blimmer Oct 15, 2026

Uh oh!

blimmer Oct 15, 2026

Uh oh!

blimmer Oct 15, 2026

Uh oh!

blimmer Oct 15, 2026

Uh oh!

jcarver989 left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

		@@ -0,0 +1,20 @@
		export const PATCHWAVE_URL = 'https://patchwave.ai/';

		@@ -0,0 +1,19 @@
		export const PATCHWAVE_URL = 'https://patchwave.ai/';

Conversation

blimmer commented Oct 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Review focus

Commits

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

jcarver989 left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

blimmer commented Oct 15, 2026 •

edited

Loading