Deep split of the security skill family

クローズ
  • 何か問題がありますか？
#1,672 コメント 0 件 リアクション 0 件 担当者 0 名 GitHub で見る

メンテナーはふだん 1 日以内に返信

まだ誰も着手していません。

評価

難易度
5/5
見積もり時間
1週間以上
初心者へのやさしさ
12/100
issue の種類
リファクタリング
明瞭さ
おおむね明確
活発さ
活発
技術スタック
markdown, python
領域
security, tooling

調査の方向性

Start with the per-skill table and the measured_tokens: stamps, then read the SKILL.md files for security-issue-import and security-cve-allocate, plus the new tools/security-management package the plan describes. Done means each skill is under the body budget and 500-line cap, with headings and golden-rule headlines unchanged, and skill-token-count, skill-surface-hash, the validator, prek run --all-files and lychee all passing. This is a multi-PR refactor that needs maintainer design input, so it is not a first contribution.

索引モデルが issue の本文から書いたものです。

説明

capability:fix capability:intake capability:resolve capability:triage contract:change-request contract:cve-authority contract:people contract:security-tracker contract:source-control contract:tracker enhancement family:ci family:docs family:security family:tools kind:perf substrate:analytics substrate:framework-dev substrate:sandbox

Part of #1342: the deep split of the security family, the same pattern as pr-management (#1570–#1585) and release-management (#1604–#1625).

The first pass (#1344) was a wording pass. The family is still the largest: 15 skills, 98,884 body tokens in total, 11 over the body budget and 7 over the 500-line cap.

skill body tokens (budget ≈ 5,850 incl. pre-flight) lines (cap 500)
security-issue-import 9,864 ⚠ 561 ⚠
security-issue-import-from-pr 8,447 ⚠ 659 ⚠
security-issue-invalidate 7,582 ⚠ 519 ⚠
security-cve-allocate 7,366 ⚠ 529 ⚠
security-issue-fix 7,163 ⚠ 494
security-issue-triage 7,130 ⚠ 534 ⚠
security-issue-import-from-md 7,095 ⚠ 523 ⚠
security-issue-sync 6,734 ⚠ 483
security-issue-import-via-forwarder 6,213 ⚠ 350
security-issue-deduplicate 5,989 ⚠ 472
security-issue-import-from-scan 5,964 ⚠ 401
security-model-verify 5,611 422
security-model-update 4,821 348
security-model-prepare 4,673 374
security-tracker-stats-dashboard 4,232 325

Body tokens are the measured_tokens: stamps, which include the frontmatter and the generated pre-flight block (~850 tokens together), so the 5,000-token body budget corresponds to about 5,850.

Approach

  • A new tools/security-management package holds the deterministic rules: classification, field extraction, tracker-body and comment rendering, and the scrub checks. The skills call it and keep only judgement and the confirmation gates.
  • SKILL.md becomes a router; rules that serve one sub-action move into one sibling file per backend or outcome.
  • Renderers are print-only. Nothing in the package posts, sends, labels or commits: every state change stays a proposal the user confirms.
  • External content stays data: anything the package reads from a report, thread or PR is passed through as quoted values, never as instructions.

Stack (one native stacked PR per layer)

  1. Package + the five import skills (issue-import, -from-pr, -from-md, -from-scan, -via-forwarder)
  2. issue-triage + issue-invalidate
  3. cve-allocate
  4. issue-sync + issue-deduplicate
  5. issue-fix

The model-* skills and tracker-stats-dashboard are under budget and stay out of scope.

Invariants

Same as #1342: headings and golden-rule headlines byte-identical, eval-extracted sections tightened only, every suite run before and after (outside the sandbox), skill-token-count, skill-surface-hash, the validator, prek run --all-files and lychee green.

主要言語
Python
スター
132
フォーク
120
平均マージ
15時間 4分
マージ済み PR（30日）
388

環境構築

はじめの一歩

  1. issue を最後まで読み、次にプロジェクトのコントリビューションガイドを読みます。
  2. 着手することを issue にコメントします — 二人が同じ作業をするのを防げます。
  3. リポジトリをフォークし、ブランチを切って変更します。
  4. issue 番号を参照したプルリクエストを送ります。

apache/magpie のほかの issue

apache/magpie の issue をすべて見る

似ている issue

Python の issue をもっと見る

新しい issue をメールで受け取る

初心者向けの GitHub issue を短くまとめたダイジェスト。