(magpie) branch main updated: fix(security-tracker-stats): recognise the framework's own comment marker (#1130)

[po...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

potiuk pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/magpie.git


The following commit(s) were added to refs/heads/main by this push:
     new d751ffae fix(security-tracker-stats): recognise the framework's own comment marker (#1130)
d751ffae is described below

commit d751ffae7be124bc7d1ae6d81b546a1310757262
Author: Jarek Potiuk <ja...@potiuk.com>
AuthorDate: Sun Aug 30 01:16:41 2026 +0200

    fix(security-tracker-stats): recognise the framework's own comment marker (#1130)
    
    The default `bot_prefixes` did not list `<!-- apache-magpie: `, the
    canonical machine marker every framework skill writes on its
    status-rollup, hand-off, and import comments. Those comments were
    therefore counted as *human triage activity*, pulling the
    time-to-triage median toward zero on any tracker the skills touch — and
    the more the skills are used, the more wrong the metric gets.
    
    At the same time the default listed `<!-- airflow-s status rollup v`, a
    marker specific to one adopter's tracker repo and meaningless to every
    other project. That is the template-genericity residue the upgrade
    flow's Step 6d audit exists to catch; #1123 removed the last
    apache-steward references but this one survived.
    
    Swaps the leaked adopter marker for the framework's own.
    
    Also corrects the README's merge documentation. It said the `milestones`
    and `categories` lists are replaced entirely, implying other lists
    merge. `deep_merge` replaces *every* list — its own docstring says
    "Lists are REPLACED, not concatenated" — so an overlay adding a single
    `bot_prefixes` entry silently drops all the defaults. That is precisely
    the trap that makes this bug hard to notice downstream: an adopter fixes
    the marker locally and unknowingly discards the rest of the list.
    
    Verified: the config still parses under the hand-rolled
    `_minimal_yaml_load` subset parser with the added comments,
    `is_bot_body` now classifies a real `<!-- apache-magpie: status-rollup
    v3 -->` comment as bot while leaving a human triage comment alone, and
    the tool's 114 tests pass.
    
    Generated-by: Claude Code (Claude Opus 5)
---
 tools/security-tracker-stats-dashboard/README.md           | 8 +++++---
 tools/security-tracker-stats-dashboard/default-config.yaml | 9 ++++++++-
 2 files changed, 13 insertions(+), 4 deletions(-)

diff --git a/tools/security-tracker-stats-dashboard/README.md b/tools/security-tracker-stats-dashboard/README.md
index a5732e39..f1c83c03 100644
--- a/tools/security-tracker-stats-dashboard/README.md
+++ b/tools/security-tracker-stats-dashboard/README.md
@@ -99,9 +99,11 @@ run is ~5–10 minutes on a 250-issue tracker; incremental re-renders
 1. `default-config.yaml` (in this directory).
 2. `$TRACKER_STATS_CONFIG` overlay YAML, when set (typically
    `<adopter-repo>/.apache-magpie-overrides/security-tracker-stats.yaml`).
-   Deep-merged with the default. **The `milestones` and `categories`
-   lists are REPLACED entirely** (not concatenated) — overlaying a
-   single category requires re-stating the whole list.
+   Deep-merged with the default. **Every list is REPLACED entirely**
+   (not concatenated) — `milestones`, `categories`, `bot_prefixes`,
+   `keywords`, and any other list-valued key. Overlaying a single
+   entry requires re-stating the whole list, otherwise the defaults
+   are silently dropped.
 3. Env-var quick overrides for the most common knobs:
    `TRACKER_STATS_BUCKETS`, `TRACKER_STATS_START`,
    `TRACKER_STATS_UPSTREAM_REPO`.
diff --git a/tools/security-tracker-stats-dashboard/default-config.yaml b/tools/security-tracker-stats-dashboard/default-config.yaml
index 5581bc16..cb8c6b90 100644
--- a/tools/security-tracker-stats-dashboard/default-config.yaml
+++ b/tools/security-tracker-stats-dashboard/default-config.yaml
@@ -163,8 +163,15 @@ triage:
     - Security Model
     - cve-worthy
     - CVE-worthy
+  # Skill-authored comments, skipped when measuring human triage
+  # activity. The first entry is the canonical machine marker every
+  # framework skill writes (`<!-- apache-magpie: <kind> vN -->`); the
+  # rest are prose prefixes from older comment shapes.
+  #
+  # NOTE: this list is REPLACED wholesale by an overlay, not merged --
+  # an overlay adding one prefix must restate the whole list.
   bot_prefixes:
-    - "<!-- airflow-s status rollup v"
+    - "<!-- apache-magpie: "
     - "**Sync "
     - "**Imported on "
     - "**Status update"