potiuk opened a new pull request, #10: URL: https://github.com/apache/airflow-steward/pull/10
## Summary Adds two new first-class comments the `sync-security-issue` skill posts on the tracker as the issue moves through the release-manager half of the lifecycle (Steps 12-15), instead of folding the call-to-action into the catch-all status rollup. The rollup is the security team's audit trail and accumulates many small entries collapsed into `<details>` blocks; the RM-facing comments are one-shot **orientation surfaces** with their own dated context and working `@`-mention notifications. A drive-by RM should be able to drive Steps 13-15 from two comments on the issue page without consulting the rollup or external docs. ## What's added ### Comment 1 — Release-manager hand-off (Step 12 trigger) Fires *exactly once* at the `pr merged` → `fix released` swap. Walks the RM through Steps 13-15 end-to-end with a numbered checklist: first paste → REVIEW → (rare conditional re-paste after CNA reviewer comments) → READY → **email preview on the `#email` tab** (new load-bearing checkpoint, see below) → send advisory → wait for publication-ready notification → second paste → PUBLIC → close. Template body: [`tools/vulnogram/release-manager-handoff-comment.md`](https://github.com/apache/airflow-steward/blob/feat/release-manager-handoff-comments/tools/vulnogram/release-manager-handoff-comment.md). Idempotent via the marker `<!-- apache-steward: release-manager-handoff v1 -->` on line 1. ### Comment 2 — Publication-ready notification (Step 14 trigger) Fires *exactly once* when the *Public advisory URL* body field is populated by sync (the existing Step 14 transition). Tells the RM the URL has been captured, the JSON has been regenerated to include it as a `vendor-advisory` reference, and the final paste + `READY` → `PUBLIC` + close is now unblocked. Template body: [`tools/vulnogram/release-manager-publication-comment.md`](https://github.com/apache/airflow-steward/blob/feat/release-manager-handoff-comments/tools/vulnogram/release-manager-publication-comment.md). Idempotent via `<!-- apache-steward: release-manager-publication-ready v1 -->`. ## Architectural split (tool-specific vs generic) The user's request was *"do it in the way that 'tool' specific part is done in the tool part in apache-steward submodule and generic workflow is explained in generic part of it"*. Concretely: | Concern | Lives in | |---|---| | Vulnogram state machine (`DRAFT` / `REVIEW` / `READY` / `PUBLIC`) + paste flow + `#email` preview tab | [`tools/vulnogram/record.md`](https://github.com/apache/airflow-steward/blob/feat/release-manager-handoff-comments/tools/vulnogram/record.md) | | Vulnogram-specific RM checklist (the standalone authoritative recipe) | [`tools/vulnogram/record.md` — *Release-manager checklist*](https://github.com/apache/airflow-steward/blob/feat/release-manager-handoff-comments/tools/vulnogram/record.md#release-manager-checklist) | | Comment template bodies (parameterised) | [`tools/vulnogram/release-manager-handoff-comment.md`](https://github.com/apache/airflow-steward/blob/feat/release-manager-handoff-comments/tools/vulnogram/release-manager-handoff-comment.md), [`release-manager-publication-comment.md`](https://github.com/apache/airflow-steward/blob/feat/release-manager-handoff-comments/tools/vulnogram/release-manager-publication-comment.md) | | When/why each comment fires, idempotency contract, placeholder substitution rules, apply mechanic | [`.claude/skills/sync-security-issue/SKILL.md`](https://github.com/apache/airflow-steward/blob/feat/release-manager-handoff-comments/.claude/skills/sync-security-issue/SKILL.md) (Step 2b + Step 4) | | RM-perspective lifecycle narrative | [`README.md` — Steps 12-15](https://github.com/apache/airflow-steward/blob/feat/release-manager-handoff-comments/README.md#step-12--fix-released) | The skill loads the comment template by resolving `tools/<cve-tool>/release-manager-{handoff,publication}-comment.md` based on the project's `cve_tool` setting in `<project-config>/project.md`, so a project that swaps Vulnogram for a different CVE tool only needs to provide its own template files (no skill changes). ## Other lifecycle clarifications - **`READY` state added** to [`tools/vulnogram/record.md`](https://github.com/apache/airflow-steward/blob/feat/release-manager-handoff-comments/tools/vulnogram/record.md#state-machine). The framework `README.md` always referenced it but the tool doc only documented `DRAFT` / `REVIEW` / `PUBLIC`. - **`#email` tab documented** as a **load-bearing email-preview checkpoint** before the advisory-send step. Fixes a real footgun: the JSON view doesn't surface formatting issues (truncation, broken markdown, missing patch links) that the rendered email does. - **Step 4 close recipe updated** to always follow `gh issue close` with an `archiveProjectV2Item` mutation on every close (terminal or non-terminal), per the new [*Archive a board item* recipe](https://github.com/apache/airflow-steward/blob/feat/release-manager-handoff-comments/tools/github/project-board.md#archive-a-board-item--terminal-state-cleanup) in `tools/github/project-board.md`. Idempotent on already-archived items. ## Deliberately unchanged - **No comment fires at `cve allocated`.** The hand-off comment deliberately fires only after the release ships — the user-facing flow before that is well-served by existing rollup status entries and would lose context by the time the release manager actually needs the call-to-action. - **No skill behaviour change for the validity / fix flow** (Steps 1-11). This is purely a downstream-of-release-ship enhancement. ## Test plan - [x] `prek run --files <touched>` passes (doctoc, eof, mixed-line- endings, trailing whitespace). - [ ] Apply the hand-off comment template to a real tracker (`#257` on `airflow-s/airflow-s` is at the `fix released` step right now) via the substituted template, verify rendering on github.com, verify the `@`-mention to `@shahar1` resolves. - [ ] Apply the publication-ready notification template to `#293` on `airflow-s/airflow-s` (already at `announced`, so this is a catch-up post for the RM who advanced the tracker before the framework feature existed). - [ ] Once a future tracker organically transitions through Steps 12 / 14 with this skill version live, verify both comments fire at the right moments and that subsequent sync runs respect the idempotency markers. 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
