[PR] generate-cve-json: warn when a credit line joins several names by comma [magpie]

["srijavuppala (via GitHub)" <gi...@apache.org>]

srijavuppala opened a new pull request, #1741:
URL: https://github.com/apache/magpie/pull/1741

   <!-- SPDX-License-Identifier: Apache-2.0
        https://www.apache.org/licenses/LICENSE-2.0 -->
   
   ## Summary
   
   - `parse_credits_from_field` splits the "Reporter credited as" / "Remediation developer" fields on newlines only (not commas), so a line like `"Name A, Name B, Name C"` is silently recorded as one joined credit with no warning.
   - Add a heuristic check, run inline where each credit line is parsed: when a line's comma-separated parts contain two or more that read as a person's name (capitalised multi-word, no affiliation-ish word), print a `warning:` to stderr naming the line, so the operator can split it before the push. The documented `Full Name, Affiliation` one-comma shape (e.g. `Jed Cunningham, Astronomer`) is unaffected and does not warn.
   - Parsing behaviour itself is unchanged — the line is still carried through as a single credit either way; this only adds the missing warning signal.
   
   ## Type of change
   
   - [x] Python package (`tools/*/` with `pyproject.toml`)
   
   ## Test plan
   
   - [ ] `prek run --all-files` passes — **could not verify end-to-end in my sandbox**: the whole-workspace `ruff`/`mypy`/`pytest` hooks shell out via `uv run` across all 48 members, and in this environment that fails for two reasons unrelated to this change: (1) the local `uv` version mis-parses this repo's `exclude-newer = "7 days"` and re-resolves `uv.lock` on every invocation, which pre-commit reports as "files modified"; (2) one unrelated member's test (`skill-token-count`) needs to download a tokenizer file from `openaipublic.blob.core.windows.net`, which my sandbox's network policy denies outright (403). I skipped `workspace-ruff-check`, `workspace-ruff-format`, `workspace-mypy`, `workspace-pytest` locally for exactly those reasons (see Notes below) — every other `prek` hook ran and passed normally.
   - [x] For Python packages touched: `uv run pytest` / `ruff check` / `mypy` passes — ran directly against `tools/cve-tool-vulnogram/generate-cve-json`: `pytest` 419 passed, `ruff check` all checks passed, `mypy` no issues found in 11 source files. Added 4 new tests covering the warning (joined names, the documented name+affiliation exception, an independent-researcher affiliation phrase, and a plain two-name case).
   
   ## RFC-AI-0004 compliance
   
   None of these rows apply: no new mutation, no new network/host access, no new placeholder-bearing prose, no agentic-override surface, no outbound messages, no privacy-LLM-routed content. This is a local, deterministic heuristic added to an existing pure-function parser.
   
   ## Linked issues
   
   Fixes #1737
   
   ## Notes for reviewers
   
   - **Generative-AI disclosure:** this PR was drafted by an AI coding agent (Claude Sonnet 5) on behalf of @srijavuppala, who reviews it before it is marked ready for review.
   - **Why a heuristic instead of a hard split:** the issue itself notes a comma can't simply be split on (the one-comma `Name, Affiliation` shape is intentionally one credit), so this only adds a warning, never changes what's parsed. The name-vs-affiliation heuristic (`_looks_like_a_persons_name`) is deliberately conservative — a missed warning is harmless (today's unchanged behaviour), so the affiliation-word list errs toward flagging a part as *not* name-like rather than risk a false "these are N names" claim.
   - **Locally skipped hooks:** `SKIP=workspace-ruff-check,workspace-ruff-format,workspace-mypy,workspace-pytest` — see Test plan above for why; happy to re-run any of them if there's a way around the sandbox's network/uv constraints that I'm missing.
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@magpie.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org