Repository navigation
feat(security): read and answer GHSA reports through the advisory comments API - #1964
Merged
Merged
Conversation
…ments API GitHub's repository security advisory comments API (public preview since 2026-10-02) lists, reads, posts and edits comments on repository security advisories, including ones created from private vulnerability reports. - security-issue-sync reads the advisory discussion on every GHSA-sourced tracker: a new `ghsa-discussion` command returns the comments new or edited since the `ghsa-discussion` rollup marker, each with its author's role (reporter, team, other) and whether the reporter is waiting for a reply. The team is the tracker collaborator roster only: `author_association` MEMBER means any member of the org. Non-team bodies come back as `body_untrusted`. - The reporter reply is posted through the API after confirmation (`ghsa-route` action `api-post`), claimed as posted only on a 201, and shown as a regular comment the reporter sees. The browser paste remains the fallback where the API does not answer (private repositories), and the email relay where the operator has no advisory access. - security-issue-import reads the reporter's follow-up comments when it imports a GHSA report; security-issue-invalidate posts its closing comment through the API. - vetted-ops gains `advisory-comments` (read) and `advisory-comment` (write, body from a workspace file). The API cannot delete comments or reach confidential (write-access-only) comments; those stay in the web UI, and the docs say so. Generated-by: Claude Opus 5
github-actions
Bot
added
family:security
1 task done
potiuk
added a commit
that referenced
this pull request
Nov 2, 2026
…nc and backfill (#1968) Builds on the advisory comments API support (#1964). - `ghsa-fields` computes the smallest PATCH that mirrors a tracker onto its GitHub repository security advisory: cve_id, the team's severity, cwe_ids, the affected range and patched version, credits (existing ones kept, plus the fix PR's author as remediation_developer and its approvers as remediation_reviewer, bots left out) and the CVE title as summary. It never writes state or collaborators, and never overwrites a different CVE. In the other direction it proposes advisory values for tracker fields that are still empty (CVE, CWE, affected range), never the severity, and shows drift where both sides differ. With `resolution` it appends a Resolution block below the reporter's text once the public advisory URL is captured. - `ghsa-backfill` returns one plan per advisory for the "sync ghsa backfill" sweep over trackers reconciled before the mirror existed. - `ghsa-mirror` syncs comments both ways: every advisory comment is copied into the tracker (idempotent by a hidden marker, rewritten when edited, author named without an @-mention); only team comments marked `To reporter:` or `<!-- to-reporter -->` are proposed for the advisory, each confirmed, never re-posted or copied back. Generated-by: Claude Opus 5
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
GitHub's repository security advisory comments API (public preview since 2026-10-02) lists, reads, posts and edits comments on repository security advisories, including the ones private vulnerability reporting creates.
Until now the security skills treated the advisory discussion as web-UI only: sync opened the advisory in the browser and printed a reply to paste, and nothing read the reporter's follow-ups.
What changes
A new
security-management issue-sync ghsa-discussioncommand returns the comments new or edited since theghsa-discussionrollup marker, each with its author's role (reporter,team,other), plusawaiting_team_replyand the next marker timestamp.The team is the tracker collaborator roster only: an
author_associationofMEMBERmeans any member of the org.Non-team bodies come back as
body_untrustedand go through the Step 1d signal table like a<security-list>message.ghsa-routeactionapi-post).It is claimed as posted only on a
201, and the proposal says it is a regular comment the reporter sees.The browser paste stays as the fallback where the comments API does not answer (private repositories, which the preview does not cover), and the email relay where the operator has no access to the advisory.
advisory-comments(read, paginated) andadvisory-comment(write, body from a workspace file).The API cannot delete comments or reach confidential (write-access-only) comments, so the docs keep those in the web UI and warn that the API's view of a thread can be missing team-only notes.
Testing
ghsa-route(API post, and the browser fallback on a missing,403or404comments read) andghsa-discussion(first read, since-marker, edits, roster-only team, untrusted bodies), plus the two vetted ops.security-issue-sync/step-1d-signalseval: 7/7 pass.Was generative AI tooling used to co-author this PR?
🤖 Generated with Claude Code