This is an automated email from the ASF dual-hosted git repository. lukaszlenart pushed a commit to branch main in repository https://gitbox.apache.org/repos/asf/struts.git
commit e3613f96d51fcbb1dc462bfc0dbda4437275b37c Merge: c8c7b4e0f 153a78997 Author: Lukasz Lenart <[email protected]> AuthorDate: Mon Oct 5 15:36:45 2026 +0200 docs(skills): carry the 7.4.0 / 6.12.0 advisory lessons into the release skills (#1987) Four baseline scenarios run against the previous skills, with project memory off-limits, each failed: - Friday publication: no skill held advisories over a weekend; the rule existed only in memory. - Version Notes after publication: "the notes may link it" led to inline bulletin links in the type sections, no Security section. - CVE record: nothing on the record's fields, so ranges were merged across lines and the title double-prefixed. - After the mails: nothing past the send button; reporter notices, the site PR and the THREAT_MODEL.md section 12 check went unmentioned. creating-security-bulletins gains a publication-day rule, a "Filling the CVE record" section (house JSON shape: one range per bulletin line, Maven purl, text severity with the GENERAL scenario, four-part description, JSON-editor write path, READY as the PMC's last step) and an "After the advisory mails" checklist. creating-version-notes defines the Security section, its place and its line format. releasing-struts updates the phase 7 gate and the publication ordering. The same four scenarios rerun against these edits all pass. Co-authored-by: Claude Opus 5.5 <[email protected]> .../skills/creating-security-bulletins/SKILL.md | 85 +++++++++++++++++++++- .claude/skills/creating-version-notes/SKILL.md | 23 +++++- .../version-notes-template.md | 2 +- .claude/skills/releasing-struts/SKILL.md | 8 +- 4 files changed, 111 insertions(+), 7 deletions(-)
