potiuk opened a new pull request, #519: URL: https://github.com/apache/airflow-steward/pull/519
## What Teach `security-issue-import` to capture and record the inbound report's root RFC-5322 `Message-ID` in the *Security mailing list thread* tracker field, alongside the Gmail `threadId` and any PonyMail URL. ## Why The field recorded only the Gmail `threadId` — an identifier that resolves **only** inside the one mailbox that holds the thread. The `Message-ID` is the archive-independent handle the reporter's MUA stamped, and the value PonyMail hashes its permalinks on, so the report stays locatable from any account or archive. ## How The claude.ai Gmail MCP `get_thread` does **not** expose the `Message-ID:` header (only Subject/From/To/Cc/Date and Gmail's opaque per-message IDs). So: - **New `oauth-draft-message-id` console script** — fetches `threads.get?format=metadata&metadataHeaders=Message-ID` via the existing OAuth refresh-token flow; stdlib-only, mirrors `oauth-draft-mark-read`. Full unit tests (network-mocked). - On the **PonyMail backend** (ASF default), the header is already in the archive result — no new fetch needed; documented as such. - `tools/gmail/operations.md` — new "Get the root `Message-ID` of a thread" section documenting the per-backend resolution path and the backtick-wrap requirement. - `security-issue-import` field-table row + body template, and `tools/github/issue-template.md` `security-thread` role — updated to record the root `Message-ID`. Note: backfilling existing trackers is operational, not part of this PR. 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
