Hacktoberfest 2026: the issues maintainers tagged for October, open and beginner-friendly. Browse Hacktoberfest issues

track project security pages update as a required post-announcement step

Closed
  • Is something wrong?
#180 0 comments 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 1 day

Nobody has claimed this yet.

Assessment

Difficulty
3/5
Estimated time
1-2 days
Newbie friendliness
72/100
Issue type
Documentation
Clarity
Clearly specified
Activity status
Quiet
Domain
documentation, security

Research direction

Start with the security-issue-sync Step 1d signal table and Step 2b release-manager hand-off comment, then read docs/security/process.md and docs/security/roles.md. Add the post-announcement security-pages checklist guidance and consider the optional security_pages_url entry in projects/_template/project.md. Done means the lifecycle documentation and hand-off prompt explicitly require updating public security pages after an advisory.

Written by the indexing model from the issue text.

Description

capability:resolve family:security good first issue kind:policy

Summary

The ASF security_committers policy
(https://www.apache.org/security/committers.html) requires as a
post-announcement step:

The project team updates the project's security pages.

Neither security-issue-sync nor any other skill, process doc,
or roles doc in this repo mentions updating the project's public
security pages (e.g. https://airflow.apache.org/security/) after
an advisory ships. A grep across the entire repo for "security page",
"update page", and "/security" returns no matches in any skill or
process document.

This means the step is silently skipped in every advisory lifecycle
run by the skills.

Where the gap shows up

security-issue-sync tracks the full advisory lifecycle through
to CVE PUBLISHED state and issue close (Steps 13–15), but the
signal table in Step 1d and the proposal items in Step 2b contain
no entry for "update the project security pages". The release
manager hand-off comment (fired at the fix released transition)
also does not include this as a checklist item.

Required changes

  1. Add an entry to the Step 1d signal table in
    security-issue-sync:

    announced label set and Public advisory URL body field
    populated, but no "security pages updated" marker recorded →
    propose adding a checklist item for the release manager to
    update the project security pages.

  2. Add a checklist item to the release-manager hand-off
    comment     (fired at the pr merged → fix released transition,
    Step 2b) that explicitly lists updating the security pages as
    a required post-advisory action.

  3. Add the step to docs/security/process.md and
    docs/security/roles.md under the release manager's
    post-announcement responsibilities.

  4. Optionally: add a project-config key in
    projects/_template/project.md for the security pages URL
    (e.g. security_pages_url) so the skill can render a
    clickable link in the checklist item rather than a generic
    placeholder.

Policy reference

Notes

This is a documentation and skill-checklist gap, not a process
logic change. The release manager still performs the update
manually; the skill just needs to prompt them to do it.

Dominant language
Python
Stars
113
Forks
95
Avg merge
10h 51m
Merged PRs (30d)
345

Getting set up

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from apache/magpie

All issues in apache/magpie

Similar issues

More Python issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.