Branch: refs/heads/xwiki-security-advisory-skill Home: https://github.com/xwiki/xwiki-dev-llm Commit: fdf0602badcf9912e25dbe1dfd6dc506a74629d1 https://github.com/xwiki/xwiki-dev-llm/commit/fdf0602badcf9912e25dbe1dfd6dc5... Author: Simon Urli <[email protected]> Date: 2026-09-09 (Wed, 09 Sep 2026) Changed paths: M README.md M xwiki/okf/index.md M xwiki/skills/xwiki-jira/SKILL.md A xwiki/skills/xwiki-security-advisory/SKILL.md Log Message: ----------- Add skill to draft GitHub security advisories from a JIRA issue The skill fetches the security-restricted JIRA issue over REST and the live advisory template + CVSS scoring guidance from the XWiki Security Policy page, then drafts the GHSA content and metadata to a work-directory file (never the repo), leaving the actual advisory creation/publishing as an explicitly-confirmed follow-up step. Co-Authored-By: Claude Sonnet 5 <[email protected]> Commit: 46c8c39771ddf71e085ef878bf71174db7eade5f https://github.com/xwiki/xwiki-dev-llm/commit/46c8c39771ddf71e085ef878bf7117... Author: Simon Urli <[email protected]> Date: 2026-09-09 (Wed, 09 Sep 2026) Changed paths: M xwiki/skills/xwiki-security-advisory/SKILL.md Log Message: ----------- Ask the user directly when the JIRA fetch fails, instead of blocking Covers missing JIRA_API_TOKEN, network/auth errors and 404s (which for a restricted issue means the account can't see it, not a bad key): the skill now asks for the same fields directly and drafts from the answers, marking anything still missing as an explicit placeholder. Co-Authored-By: Claude Sonnet 5 <[email protected]> Commit: 98066f466072d19a889f78e6c9c968dd9ba5374a https://github.com/xwiki/xwiki-dev-llm/commit/98066f466072d19a889f78e6c9c968... Author: Simon Urli <[email protected]> Date: 2026-09-09 (Wed, 09 Sep 2026) Changed paths: M xwiki/skills/xwiki-security-advisory/SKILL.md Log Message: ----------- Look at published advisories for CVSS comment wording, add commit SHA placeholder New Step 3 has the skill pull a few already-published (never draft) advisories with a similar CVSS vector and match their register when wording each row's comment, without borrowing their section structure (which still comes only from the live template). Also has the References row track the fix commit's SHA specifically, with an explicit placeholder until the fix lands, mirroring the Patches row. Co-Authored-By: Claude Sonnet 5 <[email protected]> Commit: dcdd9601fa0a20414687540deeb41e56190329d7 https://github.com/xwiki/xwiki-dev-llm/commit/dcdd9601fa0a20414687540deeb41e... Author: Simon Urli <[email protected]> Date: 2026-09-09 (Wed, 09 Sep 2026) Changed paths: M xwiki/skills/xwiki-security-advisory/SKILL.md Log Message: ----------- Add concrete guidance for the affected products/version-range fields Combines GitHub's own version-range syntax rules with the pattern every already-published XWiki advisory follows: one Affected product entry per leaf Maven module, an open-ended lower-bound-only vulnerable range, every maintained branch's patched version listed together, and the dashed dev-version notation (never the JIRA/@since RC style). Co-Authored-By: Claude Sonnet 5 <[email protected]> Compare: https://github.com/xwiki/xwiki-dev-llm/compare/fdf0602badcf%5E...dcdd9601fa0... To unsubscribe from these emails, change your notification settings at https://github.com/xwiki/xwiki-dev-llm/settings/notifications