[PR] feat(skills): reconcile GitHub repository security advisories in security-issue-sync [magpie]

["potiuk (via GitHub)" <gi...@apache.org>]

potiuk opened a new pull request, #775:
URL: https://github.com/apache/magpie/pull/775

   ## Summary
   - New subdoc `skills/security-issue-sync/github-advisory.md` + a pointer from `SKILL.md` Step 1.
   - For GHSA-sourced trackers (reports filed via GitHub "Report a vulnerability" → a
     repository security advisory on `<upstream>`), the sync now reconciles the advisory
     **record** directly via the GitHub *repository security advisories* REST API instead of
     assuming no API and relaying every reply by email.
   - **Access-tier aware:** advisory *collaborator* = read + field-edit (`cve_id`, `severity`,
     `cwe_ids`, `vulnerabilities`, `credits`); collaborator-management and publish/state require
     admin/security-manager and are surfaced as **hand-offs**, never blind-fired (a
     `state=published` success is permanent + public).
   - **Reply path:** direct-post primary (open the advisory discussion + copy-pastable block;
     the discussion thread has no REST API at any tier), with the `asf-relay` email relay kept
     as the no-collaborator fallback. Non-GitHub forwarders unaffected.
   - Records the advisory link(s) as a dedicated clickable tracker field.
   
   ## Motivation
   In real Apache Airflow sync runs the operator is an advisory collaborator on
   `apache/airflow`'s repository advisories, so reporter replies and CVE-field reconciliation no
   longer need to be relayed through the ASF security team. Verified end-to-end: read +
   field-edit work at the collaborator tier (linked a tracker's CVE onto its advisory);
   collaborator-management returned `403 "requires administrative/security management rights"` —
   exactly why the gated ops are documented as admin hand-offs, not sync writes.
   
   Originated as an adopter override (`.apache-magpie-overrides/security-issue-sync.md`,
   "Sync GitHub repository security advisories with the tracker").
   
   ## Migration path for existing adopters
   Additive + opt-in. Adopters whose `<upstream>` is not on GitHub, or whose operator is not an
   advisory collaborator, fall through to the existing email-relay path unchanged. No config
   knob, no default flip; the subdoc only activates for GHSA-sourced trackers when advisory API
   access is present.
   
   ## Test plan
   - `SKIP=lychee prek run --files skills/security-issue-sync/github-advisory.md skills/security-issue-sync/SKILL.md`
     → all hooks pass (markdownlint, typos, check-placeholders, skill-and-tool-validate, vendor-neutrality).
   - All intra-repo relative links in the new subdoc resolve.
   - Exercised in the originating adopter: advisory read; field-edit (cve_id link) at collaborator
     tier; collaborator-management + publish confirmed 403 (→ hand-off).
   
   🤖 Generated with [Claude Code](https://claude.com/claude-code)
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@magpie.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] feat(skills): reconcile GitHub repository security advisories in security-issue-sync [magpie]

["potiuk (via GitHub)" <gi...@apache.org>]

potiuk merged PR #775:
URL: https://github.com/apache/magpie/pull/775


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@magpie.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org