(struts) branch main updated (c8c7b4e0f -> e3613f96d)

[lu...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

lukaszlenart pushed a change to branch main
in repository https://gitbox.apache.org/repos/asf/struts.git


    from c8c7b4e0f docs(skills): resolve Dependabot tickets via Jira transition id (#1985)
     add 153a78997 docs(skills): carry the 7.4.0 / 6.12.0 advisory lessons into the release skills
     new e3613f96d docs(skills): carry the 7.4.0 / 6.12.0 advisory lessons into the release skills (#1987)

The 1 revisions listed above as "new" are entirely new to this
repository and will be described in separate emails.  The revisions
listed as "add" were already present in the repository and have only
been added to this reference.


Summary of changes:
 .../skills/creating-security-bulletins/SKILL.md    | 85 +++++++++++++++++++++-
 .claude/skills/creating-version-notes/SKILL.md     | 23 +++++-
 .../version-notes-template.md                      |  2 +-
 .claude/skills/releasing-struts/SKILL.md           |  8 +-
 4 files changed, 111 insertions(+), 7 deletions(-)

(struts) 01/01: docs(skills): carry the 7.4.0 / 6.12.0 advisory lessons into the release skills (#1987)

[lu...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

lukaszlenart pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/struts.git

commit e3613f96d51fcbb1dc462bfc0dbda4437275b37c
Merge: c8c7b4e0f 153a78997
Author: Lukasz Lenart <lu...@apache.org>
AuthorDate: Mon Oct 5 15:36:45 2026 +0200

    docs(skills): carry the 7.4.0 / 6.12.0 advisory lessons into the release skills (#1987)
    
    Four baseline scenarios run against the previous skills, with project
    memory off-limits, each failed:
    
    - Friday publication: no skill held advisories over a weekend; the
      rule existed only in memory.
    - Version Notes after publication: "the notes may link it" led to
      inline bulletin links in the type sections, no Security section.
    - CVE record: nothing on the record's fields, so ranges were merged
      across lines and the title double-prefixed.
    - After the mails: nothing past the send button; reporter notices,
      the site PR and the THREAT_MODEL.md section 12 check went unmentioned.
    
    creating-security-bulletins gains a publication-day rule, a "Filling
    the CVE record" section (house JSON shape: one range per bulletin line,
    Maven purl, text severity with the GENERAL scenario, four-part
    description, JSON-editor write path, READY as the PMC's last step) and
    an "After the advisory mails" checklist. creating-version-notes defines
    the Security section, its place and its line format. releasing-struts
    updates the phase 7 gate and the publication ordering.
    
    The same four scenarios rerun against these edits all pass.
    
    Co-authored-by: Claude Opus 5.5 <no...@anthropic.com>

 .../skills/creating-security-bulletins/SKILL.md    | 85 +++++++++++++++++++++-
 .claude/skills/creating-version-notes/SKILL.md     | 23 +++++-
 .../version-notes-template.md                      |  2 +-
 .claude/skills/releasing-struts/SKILL.md           |  8 +-
 4 files changed, 111 insertions(+), 7 deletions(-)