SuperAPI AI Directory
Partner with us中文AI newsFavorites
Skillsrhdh-overlay-cve-export

rhdh-overlay-cve-export

Security & auditing

View repository

Updated 10-16 02:30

About this skill

Plugin overlay CVE export

Turn overlays git history into the CSV that RHDH CVE Management expects: one row per CVE and affected plugin package, scoped to generally-available workspaces.

This is a package-inventory job, not release reporting. It answers "which plugin containers carry which CVE fix", from git — not "how is the release doing", which is /rhdh-release-status.

Route

Load workflows/overlay-cve-export.md. It covers the extract run, Jira enrichment, and the flag set.

Two references belong to this workflow alone and are read on demand:

  • references/overlay-cve-csv-format.md — the exact header, the row rule, the Container column, and the default output path.
  • references/overlay-cve-sources.md — which workspaces and commits count, how CVEs and Jira keys are extracted, and how --since resolves.

Do not reimplement the parsing

scripts/compute-plugin-package-overlay-cve-list.mjs owns commit selection, CVE extraction, pairing, dedupe, and CSV shape. Run it. Reading the overlays repo by hand and assembling rows in chat produces a different answer than the export the CVE process is checked against.

The script never calls Jira. Enrichment is a separate pass: invoke /rhdh-jira-api for the issue fields, write them to a JSON file, and feed that back through --apply-enrich.

Writing rules

The extract itself only clones and reads. Writing the enrichment JSON and the final CSV creates files on the user's disk — say where they will land and get agreement before the run that writes them. Never commit the CSV into a repository, and never post it anywhere.

Completion

Complete when the CSV path is named, the row count is stated, and the --since revision the script actually resolved is reported rather than the version string that was asked for. Every CVE without a Jira issue is listed with the overlays commit URL that stands in for it. CVSS appears only where a ProdSec CVSS field supplied it — a blank CVSS column is the correct output, never a filled-in guess. Rows dropped by the --jql filter are counted, so the user can tell an empty result from a filtered one. No credential or OAuth secret appears in any output.