From 5d9ac54df6a88dee31bf9edcd0e28c9c3b328e18 Mon Sep 17 00:00:00 2001 From: Tester Date: Tue, 7 Jul 2026 15:08:29 +0200 Subject: [PATCH] refactor(skills): push regenerated CVE JSON on every regen, not only at fix-released MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Step 5b's push mechanics are trigger-agnostic, but the only emphatic statement about *when* the push fires was the `pr merged → fix released` "not deferrable" paragraph. That prominence led an operator to hedge and skip the auto-push on advisory close-out regens, leaving live records drifted from the tracker body until a manual re-push. Make the general rule explicit: the push fires on *every* regen — advisory-URL/announced close-outs on PUBLISHED records, reviewer-feedback title/summary edits, and field corrections — with `fix released` reframed as the one instance that is also mandatory/non-deferrable. Document that a REVIEW → DRAFT state walk-back on a title/summary edit is intended. Originated as a local override in an Apache Airflow adopter (.apache-magpie-overrides/security-issue-sync.md). Generated-by: Claude Code (Claude Opus 4.8) --- skills/security-issue-sync/apply-and-push.md | 35 ++++++++++++++++++-- 1 file changed, 33 insertions(+), 2 deletions(-) diff --git a/skills/security-issue-sync/apply-and-push.md b/skills/security-issue-sync/apply-and-push.md index a3a5f67a..e5e275f6 100644 --- a/skills/security-issue-sync/apply-and-push.md +++ b/skills/security-issue-sync/apply-and-push.md @@ -455,6 +455,35 @@ instead of leaving the paste step to the release manager. The push is mechanical and follows from the same JSON the user just approved as part of the body update. +**Push trigger — every regen, not only `fix released`.** The push +above fires on **every** run that regenerates the CVE JSON (any +`generate-cve-json` / Step 5a `--attach`), not only at the +`pr merged → fix released` transition. Whenever a confirmed change +causes a regen, the regenerated JSON is pushed to the record in the +**same apply pass**, so the live record never drifts from the tracker +body. The operator's confirmation of the underlying change that +triggered the regen **is** the authorisation to push — it is not a +separate confirmation, and the push is never deferred to the release +manager. Triggers include, beyond `fix released`: + +- **advisory-URL / `announced` close-out** on an already-`public` + (Vulnogram: `PUBLIC`) record — the regen adds the + `vendor-advisory` reference captured from the *Public advisory URL* + body field, and the push writes it to the published record; +- **reviewer-feedback title / summary edits** on a record still in + `allocated` / `review-ready` (Vulnogram: `DRAFT` / `REVIEW`); +- **field corrections** — *Affected versions*, *CWE*, *Severity*, + *Reporter credited as*, *Remediation developer* — that change any + value the generator reads into the record. + +Because `push_update` writes the generator-computed `CNA_private.state` +verbatim (see below), a regen can legitimately walk a record **back** +— e.g. `review-ready → allocated` (Vulnogram: `REVIEW → DRAFT`) — when +a title or summary edit re-opens a question a reviewer had already +signed off on. That walk-back is intended: the reviewer re-reviews +from the corrected lower state. Surface every such state change in the +Step 6 recap so it is never silent. + **State auto-promote from `allocated` to `review-ready` — driven by the generator, not by sync.** The CVE JSON the generator produces already carries the correct `CNA_private.state` value based on the @@ -489,8 +518,10 @@ transition. This is the load-bearing gate for the release-manager hand-off (see Step 2b's *Two-stage gate*): the RM never receives the hand-off comment while the record is still in `allocated`. -**The `pr merged → fix released` transition performs this push in -the same apply pass — it is not deferrable.** When a sync run +**The `pr merged → fix released` transition is the one instance of +the general push-on-regen rule above that is also *mandatory*: it +performs this push in the same apply pass and it is not deferrable.** +When a sync run advances a tracker `pr merged → fix released`, the label flip and this 5a-regen + 5b-push are **one atomic unit**: the user's confirmation of the transition authorises the push, and both land in