[PR] feat(project-agnosticism): add security-intake capability-flag vocabulary [airflow-steward]

["justinmclean (via GitHub)" <gi...@apache.org>]

justinmclean opened a new pull request, #559:
URL: https://github.com/apache/airflow-steward/pull/559

   ## Summary
   
   Introduces projects/_template/security-intake-config.md — a companion config doc for the security-intake and CVE-allocation skill families, following the pattern established by committer-onboarding-config.md and release-management-config.md.
   
   The file does two things:
   1. Names every allowed value for the key intake and allocation flags already declared in project.md (security_inbox.kind, cve_authority.tool, governance.cve_allocation_gate, forwarders.enabled) so a non-ASF adopter can scan one document instead of hunting project.md comments.
   2. Introduces new disclosure_governance flags not present in project.md: window_days (CVD window; ASF default 90), grace_period_days (ASF default 14), reporter_acknowledgement_model (manual/auto/none), and pre_announce_distributors (false/true). Skills will read these flags in follow-on updates to replace hard-coded ASF defaults.
   
   Updates project-agnosticism.md Known Gaps to reflect that security-intake and CVE-allocation vocabulary is now documented here, and contributor-intake vocabulary is covered by committer-onboarding-config.md (capability-flags- committer-intake work item).
   
   Generated-by: Claude (Opus 4.7)
   
   ## Type of change
   
   <!-- Tick all that apply. -->
   
   - [ ] Skill change (`.claude/skills/<name>/`) — eval fixtures updated below
   - [ ] Tool / bridge contract (`tools/<system>/*.md`)
   - [ ] Python package (`tools/*/` with `pyproject.toml`)
   - [ ] Groovy reference impl
   - [ ] Cross-cutting (RFC, AGENTS.md, sandbox, privacy-LLM)
   - [X] Documentation (`docs/`, `README.md`, `CONTRIBUTING.md`)
   - [ ] Project template (`projects/_template/`)
   - [ ] CI / dev loop (`prek`, workflows, validators)
   - [ ] Other:
   
   ## Test plan
   
   - [X] `prek run --all-files` passes
   - [ ] For Python packages touched: `uv run pytest` / `ruff check` / `mypy` passes
   - [ ] For Groovy bridges touched: command-line invocation tested end-to-end
   - [ ] For skill changes: eval suite passes for the affected skill
         (`PYTHONPATH=tools/skill-evals/src python3 -m skill_evals.runner tools/skill-evals/evals/<skill>/`)
   - [ ] For skill *behaviour* changes: a new or updated eval fixture is included in this PR
         (a regression test for the bug fixed / the behaviour added — see CONTRIBUTING.md)
   - [ ] Other:


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] feat(project-agnosticism): add security-intake capability-flag vocabulary [airflow-steward]

["potiuk (via GitHub)" <gi...@apache.org>]

potiuk merged PR #559:
URL: https://github.com/apache/airflow-steward/pull/559


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org