[PR] feat(security-issue-fix): fix a Subversion project with a private patch and a gated commit [magpie]

["potiuk (via GitHub)" <gi...@apache.org>]

potiuk opened a new pull request, #1651:
URL: https://github.com/apache/magpie/pull/1651

   ## Summary
   
   - `security-issue-fix` assumed Git and published with `gh pr create`. On a project whose code lives in Subversion the commit itself is the publication, so a fix there needs a different flow: a private patch first, and a commit only once the team has cleared it.
   - `magpie-vcs fix-flow` picks the flow from the project's Source control value (`pull-request` for Git-like backends, `patch-then-commit` for svn; a working copy that contradicts the manifest is an error). Git projects keep today's flow unchanged.
   - On svn the fix is written locally, shared as a private patch (tracker attachment, or an unsent `<security-list>` draft), and committed only after the user confirms the team cleared it. `magpie-vcs scrub` checks the commit message, the lines the diff adds and the branch name; `propose-commit` lists what `svn commit` would publish and blocks on unexpected paths, conflicts or a scrub hit; `commit --scrub` / `new-branch --scrub` refuse on a hit (exit 3), so the scrub gates the steps where an SVN change becomes public (the review point raised on #1609).
   
   ## Type of change
   
   - [x] Skill change (`.claude/skills/<name>/`) — eval fixtures updated below
   - [x] Python package (`tools/*/` with `pyproject.toml`)
   - [x] Project template (`projects/_template/`)
   - [x] Documentation (`docs/`, `README.md`, `CONTRIBUTING.md`)
   
   ## Test plan
   
   - [x] `tools/vcs`: pytest (publication gate, scrub, fix-flow choice, propose-commit; svn behaviour with fakes and mocked `svn status --xml`), `ruff check`, `ruff format --check`, `mypy`
   - [x] New eval steps for `security-issue-fix`: `step-0-fix-flow` (3 cases), `step-8-svn-share-patch` (3), `step-9-svn-publication-gate` (5); fictional project and a made-up CVE id only
   - [x] skill-evals pytest; `skill-surface-hash` and `skill-token-count --check` in sync; typos clean
   - [ ] `prek run --all-files` — left to CI (prepared outside a checkout)
   - [ ] Real-`svn` integration tests were skipped locally (no usable `svn` under the sandbox); CI runs them where `svn` is installed
   
   ## RFC-AI-0004 compliance
   
   - [x] **HITL** — sharing the patch and the commit are separate proposals; the commit only after the user confirms the team cleared it
   - [x] **Sandbox** — no new network reach
   - [x] **Vendor neutrality** — placeholders only
   - [x] **Write-access discipline** — the `<security-list>` message is an unsent draft
   - [x] **Privacy LLM** — the patch goes only to private surfaces
   
   ## Linked issues
   
   Refs #1638 (stacked on the setup PR that closes it)
   
   ## Notes for reviewers (optional)
   
   - Stacked on `feat/setup-detect-svn`: both touch `tools/vcs` and the `project.md` template.
   - `--scrub` is opt-in on `commit` / `new-branch` because `tools/vcs` is generic; the security fix flow always passes it.
   - svn has no commit trailers, so the attribution line goes as the last line of the message.
   
   ---
   
   Generative AI disclosure: prepared with Claude Code (Claude Opus 5); reviewed by the author.
   
   🤖 Generated with [Claude Code](https://claude.com/claude-code)
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@magpie.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] feat(security-issue-fix): fix a Subversion project with a private patch and a gated commit [magpie]

["potiuk (via GitHub)" <gi...@apache.org>]

potiuk merged PR #1651:
URL: https://github.com/apache/magpie/pull/1651


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@magpie.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org