(magpie) branch main updated: docs(security): codify two security-workflow conventions (#738)

[po...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

potiuk pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/magpie.git


The following commit(s) were added to refs/heads/main by this push:
     new 9955774c docs(security): codify two security-workflow conventions (#738)
9955774c is described below

commit 9955774cb0b4944285873c5bf7f9e6ae178ffb3f
Author: Jarek Potiuk <ja...@potiuk.com>
AuthorDate: Sat Jul 4 16:12:55 2026 +0200

    docs(security): codify two security-workflow conventions (#738)
    
    security-issue-fix (Step 5f): for projects whose changelog is generated by the
    release manager from commit messages (no per-PR fragments), a fix PR must not
    author version/category headers or bulleted / PR-linked changelog entries; at
    most a single top-of-changelog note for a notable user-visible behaviour change,
    which the release manager relocates into the right version at release.
    
    security-issue-import (Step 7, rejections-ledger): every `<!-- rejection v1 -->`
    entry must carry the thread `title:` and a stable mail-archive `archive:`
    permalink in addition to the mailbox `thread:` id, so each rejected report is
    archive-locatable and human-scannable for anyone auditing the ledger / the
    tracker-stats dashboard. Includes an `unresolved (archive lag)` fallback.
    
    Co-authored-by: Tester <t...@example.com>
---
 skills/security-issue-fix/SKILL.md    | 18 ++++++++++++++++++
 skills/security-issue-import/SKILL.md | 17 ++++++++++++++++-
 2 files changed, 34 insertions(+), 1 deletion(-)

diff --git a/skills/security-issue-fix/SKILL.md b/skills/security-issue-fix/SKILL.md
index 4f3a7e1c..ad0a9c4a 100644
--- a/skills/security-issue-fix/SKILL.md
+++ b/skills/security-issue-fix/SKILL.md
@@ -620,6 +620,24 @@ reveals the security nature and defeats the whole point of the
 private tracking workflow. Skip this section entirely for projects
 whose `release_process.newsfragments.enabled` is `false`.
 
+**Commit-message-driven changelogs (no per-PR fragments).** Some
+projects do not use fragment files at all — their changelog is
+regenerated by the release manager from commit messages at
+release-preparation time. On such a project the fix PR must **not**
+author a new version header, a new category section (`Bug Fixes`,
+`Features`, `Breaking changes`, …), or a bulleted / PR-linked
+changelog entry — those are the release manager's to generate. The
+only changelog edit a fix PR should make is, **when a notable
+user-visible behaviour change needs surfacing**, a single note at the
+very top of the changelog (above the first version header) describing
+the change and any migration step; the release manager relocates and
+formalises it into the right version at release. Whether the project
+is fragment-based or commit-message-driven, and where such a note
+goes, lives in
+[`<project-config>/fix-workflow.md`](../../<project-config>/fix-workflow.md).
+The neutral-language / no-security-framing rule above applies to the
+note as well.
+
 ### 5g. PR body draft
 
 Write out the exact `--body` the skill will pass to
diff --git a/skills/security-issue-import/SKILL.md b/skills/security-issue-import/SKILL.md
index 54063377..6afa0d3f 100644
--- a/skills/security-issue-import/SKILL.md
+++ b/skills/security-issue-import/SKILL.md
@@ -1946,11 +1946,26 @@ media / cross-thread-followup / fix-already-public):
    <!-- rejection v1 -->
    date: <YYYY-MM-DD>
    reporter: <reporter email or display name>
+   title: <thread subject, verbatim — strip Re:/Fwd:>
    canned: <canned-response-slug>
-   thread: <Gmail/PonyMail thread URL or threadId>
+   thread: <mailbox threadId>
+   archive: <stable mail-archive permalink (e.g. lists.apache.org/thread/<hash>), or "unresolved (archive lag)">
    summary: <one-line disposition>
    ```
 
+   Record **`title:`** (the verbatim thread subject) and **`archive:`**
+   (a stable mail-archive permalink) in addition to the mailbox
+   `thread:` id. A bare mailbox threadId resolves only inside the one
+   mailbox that holds it; the archive permalink plus the title make
+   each rejected report archive-locatable and human-scannable for
+   anyone auditing the ledger / the tracker-stats dashboard. Resolve
+   the permalink from the project's configured mail archive (for ASF
+   projects, PonyMail: search the list archive for the thread and take
+   its `lists.apache.org/thread/<hash>` permalink); if the thread is
+   not yet indexed (brand-new inbound mail lags the archive), record
+   `archive: unresolved (archive lag)` and keep the mailbox
+   `thread:` id so a later run can backfill it.
+
    ```bash
    gh api repos/<tracker>/issues/$LEDGER/comments \
      -F body=@/tmp/rejection-<threadId>.md --jq '.id'