[PR] feat(security-issue-sync): record a published CVE in the project's own security records [magpie]

["potiuk (via GitHub)" <gi...@apache.org>]

potiuk opened a new pull request, #1652:
URL: https://github.com/apache/magpie/pull/1652

   ## Summary
   
   - After a CVE is public, projects record it in their own published security records, which their site builds from. Magpie only posted a reminder; now `security-issue-sync` proposes the actual change, over Git or Subversion.
   - New `advisory-records` planner (in `generate-cve-json`) for the two layouts projects use:
     - **`cve-json-file`** — one CVE 5.x JSON file per CVE in a site repository, rendered from the `generate-cve-json` record (httpd keeps its records this way, today in its Git site repository).
     - **`release-page`** — an entry in a per-release-line page (XML or Markdown), added to the fixed release's section and creating it newest-first when absent, from adopter-configured templates (Tomcat keeps one such page per release line in its site Subversion). Shipped example templates follow that shape.
   - It refuses until cve.org reports the record `PUBLISHED` with a `vendor-advisory` reference, escapes all tracker text, is idempotent, and prints the file change plus the `magpie-vcs` commands as a proposal (`--apply` writes only the file). Configured by a new `advisory_records` block in `project.md`; unset, nothing changes. `tools/vcs` gains `update` and `checkout`.
   
   ## Type of change
   
   - [x] Skill change (`.claude/skills/<name>/`) — eval fixtures updated below
   - [x] Python package (`tools/*/` with `pyproject.toml`)
   - [x] Project template (`projects/_template/`)
   - [x] Documentation (`docs/`, `README.md`, `CONTRIBUTING.md`)
   
   ## Test plan
   
   - [x] `generate-cve-json`: 25 new tests (both layouts, Git and SVN command rendering, idempotency, section ordering, escaping, refusal before publication, unparsable page, CRLF, Markdown); `ruff check`, `mypy` clean
   - [x] `tools/vcs`: pytest (git and CLI paths; svn/hg skipped locally), `ruff check`, `mypy`
   - [x] `security-issue-sync` step-2b eval cases 11 (proposal after publication) and 12 (nothing while cve.org has not published)
   - [x] skill-evals pytest; `skill-surface-hash` and `skill-token-count --check` in sync; typos clean
   - [ ] `prek run --all-files` — left to CI (prepared outside a checkout)
   
   ## RFC-AI-0004 compliance
   
   - [x] **HITL** — a proposal; the commands run one by one only after confirmation
   - [x] **Vendor neutrality** — layouts and templates are generic and adopter-configured; fixtures use made-up CVE ids and fictional products
   - [x] **Write-access discipline** — nothing is committed or pushed without the user's yes
   
   ## Linked issues
   
   Stacked on the Subversion fix-flow PR (`feat/security-fix-svn`), which is stacked on the setup PR closing #1638.
   
   ## Notes for reviewers (optional)
   
   - The planner does not create the first page of a brand-new release line; it refuses and asks for it to be added by hand.
   - httpd and Tomcat are named only as examples of the two layouts in the docs, never with any vulnerability content.
   
   ---
   
   Generative AI disclosure: prepared with Claude Code (Claude Opus 5); reviewed by the author.
   
   🤖 Generated with [Claude Code](https://claude.com/claude-code)
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@magpie.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] feat(security-issue-sync): record a published CVE in the project's own security records [magpie]

["potiuk (via GitHub)" <gi...@apache.org>]

potiuk merged PR #1652:
URL: https://github.com/apache/magpie/pull/1652


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@magpie.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org