Drupal 8/CiviCRM has the [composer-patches](https://github.com/cweagans/composer-patches) package already installed.  So you can add a section to the `"extra"` element in `composer.json` called `"patches"`, and list out the patch with a title and a URL (or path) to a `.diff` file.  Here's an example where I add four patches to standard CiviCRM:

```diff
diff --git a/composer.json b/composer.json
index 453ff74..5827a69 100644
--- a/composer.json
+++ b/composer.json
@@ -68,6 +68,14 @@
         ]
     },
     "extra": {
+        "patches": {
+          "civicrm/civicrm-core": {
+            "core#609, PR 13390.": "https://patch-diff.githubusercontent.com/raw/civicrm/civicrm-core/pull/13390.diff",
+            "core#580, PR 13373.": "https://patch-diff.githubusercontent.com/raw/civicrm/civicrm-core/pull/13373.diff",
+            "membership#9, PR#13553 (membership renewal notification fix)": "https://patch-diff.githubusercontent.com/raw/civicrm/civicrm-core/pull/13553.diff",
+            "reporting#8, PR 13653 (thank-you dates on contribution reports)": "https://patch-diff.githubusercontent.com/raw/civicrm/civicrm-core/pull/13653.diff"
+          }
+        },
         "patchLevel": {
             "drupal/core": "-p2"
         },
```

**Note:** If you don't use the excellent `roundearth/civicrm-composer-plugin` but instead use the [full manual process](https://www.mydropwizard.com/blog/how-install-civicrm-drupal-8-and-why-choose-it-over-pure-drupal-crm) to update CiviCRM, you'll need to perform the update steps every time you run `composer install` with patches.