You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@magpie.apache.org by po...@apache.org on 2026/10/03 21:40:18 UTC
(magpie) branch main updated: perf(security-import): move the tracker body templates into siblings (#1499)
This is an automated email from the ASF dual-hosted git repository.
potiuk pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/magpie.git
The following commit(s) were added to refs/heads/main by this push:
new 6c9ae423 perf(security-import): move the tracker body templates into siblings (#1499)
6c9ae423 is described below
commit 6c9ae423a6a326d7cd848c9ed7cf8cb5da0ab20a
Author: Jarek Potiuk <ja...@potiuk.com>
AuthorDate: Sat Oct 3 23:40:12 2026 +0200
perf(security-import): move the tracker body templates into siblings (#1499)
security-issue-import-from-md and -from-pr each carried their issue
body heredoc inline. Move each block byte-identically into a
tracker-body-template.md sibling, linked from the step that writes
the body. No heading outside the templates changes. surface_hash still moves, because
the hash counts the issue-body headings inside the heredoc.
import-from-md is also rewrapped to one sentence per line in Steps 3
and 5, with no word changes, bringing it under the 500-line cap
(575 -> 494). import-from-pr goes 679 -> 629.
Generated-by: Claude Opus 5
---
.../skills/issue-import-from-md/SKILL.md | 108 +++------------------
.../issue-import-from-md/tracker-body-template.md | 71 ++++++++++++++
.../skills/issue-import-from-pr/SKILL.md | 56 +----------
.../issue-import-from-pr/tracker-body-template.md | 56 +++++++++++
4 files changed, 143 insertions(+), 148 deletions(-)
diff --git a/plugins/magpie-security/skills/issue-import-from-md/SKILL.md b/plugins/magpie-security/skills/issue-import-from-md/SKILL.md
index 80bbf6fb..044350c3 100644
--- a/plugins/magpie-security/skills/issue-import-from-md/SKILL.md
+++ b/plugins/magpie-security/skills/issue-import-from-md/SKILL.md
@@ -25,9 +25,9 @@ when_to_use: |
anchor the import on (`security-issue-import-from-pr`).
argument-hint: "[path-to-markdown-file]"
capability: capability:intake
-surface_hash: sha256:a0bf5966806f210a
+surface_hash: sha256:436e75c5ccc0c6cf
license: Apache-2.0
-measured_tokens: 6799
+measured_tokens: 6521
---
<!-- Placeholder convention (see AGENTS.md#placeholder-convention-used-in-skill-files):
@@ -263,10 +263,7 @@ For each finding, prepare the tracker fields:
### 3a — Title
-The tracker title is the finding's `# Title` with the standard
-`[ Security Report ]` prefix prepended (per the issue-template
-convention; see
-[`tools/github/issue-template.md`](../../../../tools/github/issue-template.md)):
+The tracker title is the finding's `# Title` with the standard `[ Security Report ]` prefix prepended (per the issue-template convention; see [`tools/github/issue-template.md`](../../../../tools/github/issue-template.md)):
```text
[ Security Report ] <finding title>
@@ -276,12 +273,7 @@ The title is otherwise untouched — title normalisation runs later, in `securit
### 3b — Issue body
-Map markdown sections to the standard `<tracker>` issue-template
-body fields (per
-[`tools/github/issue-template.md`](../../../../tools/github/issue-template.md);
-the role → concrete-name mapping comes from
-[`<project-config>/project.md`](../../../../<project-config>/project.md#issue-template-fields),
-with the heading literals declared under `tracker.body_fields`):
+Map markdown sections to the standard `<tracker>` issue-template body fields (per [`tools/github/issue-template.md`](../../../../tools/github/issue-template.md); the role → concrete-name mapping comes from [`<project-config>/project.md`](../../../../<project-config>/project.md#issue-template-fields), with the heading literals declared under `tracker.body_fields`):
| Markdown source | Tracker body field | Shape |
|---|---|---|
@@ -302,10 +294,7 @@ it is useful triage context but belongs in no template field, and there it stays
### 3c — Labels
-Apply at creation (the concrete label names come from
-`tracker.labels` in `<project-config>/project.md` —
-`needs_triage` and `security_marker`; literals below are the
-framework defaults):
+Apply at creation (the concrete label names come from `tracker.labels` in `<project-config>/project.md` — `needs_triage` and `security_marker`; literals below are the framework defaults):
- **`needs triage`** — every finding from this skill enters the
standard validity-assessment flow.
@@ -315,9 +304,7 @@ framework defaults):
Do **not** apply a scope label; it is assigned at Step 5 of the handling process, after the validity assessment.
The vocabulary lives in
-[`scope-labels.md`](../../../../<project-config>/scope-labels.md)
-and is enumerated under `scope_detection.labels` in
-[`<project-config>/project.md`](../../../../<project-config>/project.md#scope-detection).
+[`scope-labels.md`](../../../../<project-config>/scope-labels.md) and is enumerated under `scope_detection.labels` in [`<project-config>/project.md`](../../../../<project-config>/project.md#scope-detection).
### 3d — Project board
@@ -328,11 +315,9 @@ the skill still sets `Status` to `Needs triage` with `updateProjectV2ItemFieldVa
### 3e — Status-rollup comment
-The first entry on the tracker's status rollup
-([`tools/github/status-rollup.md`](../../../../tools/github/status-rollup.md)),
-with the action label `Import from markdown (<basename>, finding <K>/<N>)`.
-Draft only the entry body; Step 5d's tool writes the `<details>` envelope
-and creates the rollup with its marker line:
+The first entry on the tracker's status rollup ([`tools/github/status-rollup.md`](../../../../tools/github/status-rollup.md)), with the action label `Import from markdown (<basename>, finding <K>/<N>)`.
+Draft only the entry body;
+Step 5d's tool writes the `<details>` envelope and creates the rollup with its marker line:
```markdown
**Imported from markdown file `<basename>` on <YYYY-MM-DD>** (severity: `<severity>`, category: `<category>`).
@@ -397,76 +382,10 @@ The batch is a serial loop, **not** parallel, so the `gh` calls and board mutati
### 5a — Create the tracker via `gh api`
-Bypasses the form so the `Security mailing list thread`
-required-field check does not fire. Same pattern as
-[`security-issue-import-from-pr`'s](../issue-import-from-pr/SKILL.md#7a--create-the-tracker-via-gh-api) Step 7a.
+Bypasses the form so the `Security mailing list thread` required-field check does not fire.
+Same pattern as [`security-issue-import-from-pr`'s](../issue-import-from-pr/SKILL.md#7a--create-the-tracker-via-gh-api) Step 7a.
-Write the body to a temp file (per finding):
-
-```bash
-cat > <scratch>/import-md-<basename>-<index>-body.md <<'EOF'
-### The issue description
-
-> **Imported from markdown file `<basename>` (finding <K>/<N>)** — there is no inbound `<security-list>` report; the markdown sections below are the verbatim source.
-
-**Details:**
-
-<## Details payload, verbatim>
-
-**Impact:**
-
-<## Impact payload, verbatim>
-
-**Reproduction steps:**
-
-<## Reproduction steps payload, verbatim>
-
-### Short public summary for publish
-
-_No response_
-
-### Affected versions
-
-`<owner>/<repo>` @ `<branch>` — versions to be confirmed during triage.
-
-### Security mailing list thread
-
-N/A — imported from markdown file `<basename>`; no <security-list> thread.
-
-### Public advisory URL
-
-_No response_
-
-### Reporter credited as
-
-_No response_
-
-### PR with the fix
-
-<location_url if it points at a <upstream> PR, else _No response_>
-
-### Remediation developer
-
-_No response_
-
-### CWE
-
-<category from metadata; free-text — actual CWE assigned at triage>
-
-### Severity
-
-<severity from metadata>
-
-### CVE tool link
-
-_No response_
-
-<details><summary>Recommended fix (per the source markdown)</summary>
-
-<## Recommended fix payload, verbatim>
-</details>
-EOF
-```
+Write the body to a temp file (per finding) from the template in [`tracker-body-template.md`](tracker-body-template.md).
Create it per the safe-create recipe in
[`tools/github/operations.md`](../../../../tools/github/operations.md#create) — the finding title is attacker-controlled.
@@ -482,8 +401,7 @@ gh api repos/<tracker>/issues \
--jq '.number, .node_id, .html_url'
```
-No scope label, no `pr created` / `pr merged` — those come later
-in the lifecycle.
+No scope label, no `pr created` / `pr merged` — those come later in the lifecycle.
Capture `number`, `node_id`, `html_url` from the response.
diff --git a/plugins/magpie-security/skills/issue-import-from-md/tracker-body-template.md b/plugins/magpie-security/skills/issue-import-from-md/tracker-body-template.md
new file mode 100644
index 00000000..03e7b935
--- /dev/null
+++ b/plugins/magpie-security/skills/issue-import-from-md/tracker-body-template.md
@@ -0,0 +1,71 @@
+<!-- SPDX-License-Identifier: Apache-2.0
+ https://www.apache.org/licenses/LICENSE-2.0 -->
+
+# security-issue-import-from-md — tracker body template
+
+The Step 5a body file, written per finding with every `<…>` placeholder filled.
+
+```bash
+cat > <scratch>/import-md-<basename>-<index>-body.md <<'EOF'
+### The issue description
+
+> **Imported from markdown file `<basename>` (finding <K>/<N>)** — there is no inbound `<security-list>` report; the markdown sections below are the verbatim source.
+
+**Details:**
+
+<## Details payload, verbatim>
+
+**Impact:**
+
+<## Impact payload, verbatim>
+
+**Reproduction steps:**
+
+<## Reproduction steps payload, verbatim>
+
+### Short public summary for publish
+
+_No response_
+
+### Affected versions
+
+`<owner>/<repo>` @ `<branch>` — versions to be confirmed during triage.
+
+### Security mailing list thread
+
+N/A — imported from markdown file `<basename>`; no <security-list> thread.
+
+### Public advisory URL
+
+_No response_
+
+### Reporter credited as
+
+_No response_
+
+### PR with the fix
+
+<location_url if it points at a <upstream> PR, else _No response_>
+
+### Remediation developer
+
+_No response_
+
+### CWE
+
+<category from metadata; free-text — actual CWE assigned at triage>
+
+### Severity
+
+<severity from metadata>
+
+### CVE tool link
+
+_No response_
+
+<details><summary>Recommended fix (per the source markdown)</summary>
+
+<## Recommended fix payload, verbatim>
+</details>
+EOF
+```
diff --git a/plugins/magpie-security/skills/issue-import-from-pr/SKILL.md b/plugins/magpie-security/skills/issue-import-from-pr/SKILL.md
index 9d2726be..03d2615e 100644
--- a/plugins/magpie-security/skills/issue-import-from-pr/SKILL.md
+++ b/plugins/magpie-security/skills/issue-import-from-pr/SKILL.md
@@ -18,9 +18,9 @@ when_to_use: |
`security-issue-import`.
argument-hint: "[pr-number] [repo:owner/name]"
capability: capability:intake
-surface_hash: sha256:249e4ff2ba6b1d91
+surface_hash: sha256:4a4f2d125526784d
license: Apache-2.0
-measured_tokens: 8059
+measured_tokens: 7895
---
<!-- Placeholder convention (see AGENTS.md#placeholder-convention-used-in-skill-files):
@@ -536,59 +536,9 @@ Sequenced. Each step depends on the previous one's output.
Creating through `gh api` bypasses the form's required-field check on `Security mailing list thread`,
as [`security-issue-import`'s](../issue-import/SKILL.md) Step 7 does.
-Write the body to a temp file.
+Write the body to a temp file from the template in [`tracker-body-template.md`](tracker-body-template.md).
`<scratch>` is the session scratch directory as an absolute path (fall back to `$TMPDIR`); `gh` may run outside the sandbox, where `$TMPDIR` differs, so pass it absolute paths.
-```bash
-cat > <scratch>/import-pr-<N>-body.md <<'EOF'
-### The issue description
-
-> **Imported from public PR <upstream>#<N>** — there is no inbound `security@` report; the PR description below is the public statement of the vulnerability.
-
-<verbatim PR body>
-
-### Short public summary for publish
-
-_No response_
-
-### Affected versions
-
-<per-scope shape>
-
-### Security mailing list thread
-
-N/A — opened from public PR <pr.url>; no security@ thread
-
-### Public advisory URL
-
-_No response_
-
-### Reporter credited as
-
-<proposed reporter>
-
-### PR with the fix
-
-<pr.url>
-
-### Remediation developer
-
-<proposed remediation developer>
-
-### CWE
-
-_No response_
-
-### Severity
-
-<proposed severity>
-
-### CVE tool link
-
-_No response_
-EOF
-```
-
Create it per the safe-create recipe in
[`tools/github/operations.md`](../../../../tools/github/operations.md#create):
title file `<scratch>/import-pr-<N>-title.txt` holding the cleaned title (it derives from the attacker-controlled PR title),
diff --git a/plugins/magpie-security/skills/issue-import-from-pr/tracker-body-template.md b/plugins/magpie-security/skills/issue-import-from-pr/tracker-body-template.md
new file mode 100644
index 00000000..64e5a6f7
--- /dev/null
+++ b/plugins/magpie-security/skills/issue-import-from-pr/tracker-body-template.md
@@ -0,0 +1,56 @@
+<!-- SPDX-License-Identifier: Apache-2.0
+ https://www.apache.org/licenses/LICENSE-2.0 -->
+
+# security-issue-import-from-pr — tracker body template
+
+The Step 7a body file, written per PR with every `<…>` placeholder filled.
+
+```bash
+cat > <scratch>/import-pr-<N>-body.md <<'EOF'
+### The issue description
+
+> **Imported from public PR <upstream>#<N>** — there is no inbound `security@` report; the PR description below is the public statement of the vulnerability.
+
+<verbatim PR body>
+
+### Short public summary for publish
+
+_No response_
+
+### Affected versions
+
+<per-scope shape>
+
+### Security mailing list thread
+
+N/A — opened from public PR <pr.url>; no security@ thread
+
+### Public advisory URL
+
+_No response_
+
+### Reporter credited as
+
+<proposed reporter>
+
+### PR with the fix
+
+<pr.url>
+
+### Remediation developer
+
+<proposed remediation developer>
+
+### CWE
+
+_No response_
+
+### Severity
+
+<proposed severity>
+
+### CVE tool link
+
+_No response_
+EOF
+```