Repository navigation
Conversation
Add the ASF-wide sender default and collect project-specific CNA reviewer addresses during setup so bookkeeping messages are filtered before later intake steps. Generated-by: Codex (GPT-5)
github-actions
Bot
added
family:security
Kaap10
reviewed
Oct 21, 2026
Kaap10
left a comment
Kaap10
left a comment
Contributor
There was a problem hiding this comment.
Thank you for addressing #1735!
Review Summary
Adding security@apache.org to organizations/ASF/organization.md as the organization-wide bookkeeping sender directly resolves the issue where automated CVE reservation emails bypassed Step 1 pre-filtering into triage intake.
Key Strengths
- Clean Organization Baseline:
- Defining
security_inbox.cve_tool_senders: [security@apache.org]underorganizations/ASF/organization.mdensures all ASF adopters inherit the correct sender filter without needing manual overrides.
- Defining
- Setup Guidance & RFC-AI-0004 Compliance:
- Step 4b and Step 9 in
install.mdinstruct setup to ask for confirmed CNA reviewer addresses and explicitly forbid guessing personal addresses. - Accurately explains configuration replacement semantics: if a project defines reviewer addresses, setup includes both
security@apache.organd the confirmed addresses because project values replace rather than merge with organization defaults.
- Step 4b and Step 9 in
- Template & Documentation Alignment:
- Comments in
templates/project.mdandcandidate-listing.mdclearly document wherecve_tool_sendersresolves from and how adopters should configure it.
- Comments in
- Targeted Regression Testing:
test_prefilter_drops_asf_cna_bookkeeping_from_configured_sendersintest_issue_import.pyprovides clean regression coverage for both reservation and reviewer-comment subjects.
Minor Recommendation
- The branch was branched from
30ab868eand is slightly behindmain. While it merges cleanly with zero conflicts (git merge-treeverified), rebasing ontoupstream/mainis recommended so GitHub Actions CI triggers and runs tests against latest HEAD.
| security_inbox: | ||
| kind: mailing-list | ||
| foundation_security_address: security@apache.org # ASF security team forwards reports here | ||
| cve_tool_senders: [security@apache.org] # organization-wide CVE bookkeeping sender |
Contributor
There was a problem hiding this comment.
Providing cve_tool_senders: [security@apache.org] here establishes the correct baseline for all ASF projects, preventing automated reservation notices from leaking into triage intake without requiring boilerplate configuration in every adopter's project.md.
| - `dev_list` is the target of the `dev` or `issues` or `pullrequests` notification containing `dev@`. If not found, default to `dev@<project>.apache.org`. | ||
| - `users_list` is the target of the `users` notification, or defaults to `users@<project>.apache.org`. | ||
| - `security_list` has no default: not every ASF project has a dedicated `security@<project>.apache.org` list. Detect it and ask, as [`adopt.md` Step 4b](adopt.md#4b--scaffold-whatever-is-still-missing) does; when no dedicated list is found, recommend requesting one from ASF Infra and offer `private@<project>.apache.org` only as a flagged fallback. | ||
| - `security_inbox.cve_tool_senders` inherits `security@apache.org` from the ASF organization profile. Ask which ASF CNA reviewers currently send CVE-tool notifications to the project. If the answer is non-empty, write one project-level list containing `security@apache.org` and the confirmed reviewer addresses because project values replace, rather than merge with, organization defaults. An empty answer leaves the key absent and keeps the inherited address; never guess reviewer addresses. |
Contributor
There was a problem hiding this comment.
Explicitly noting that project values replace rather than merge with organization defaults is critical here: it prevents adopters from accidentally omitting security@apache.org when adding specific CNA reviewers.
| assert [t["thread_id"] for t in out["dropped"]] == ["t-bookkeeping"] | ||
|
|
||
|
|
||
| def test_prefilter_drops_asf_cna_bookkeeping_from_configured_senders(capsys, tmp_path) -> None: |
Contributor
There was a problem hiding this comment.
Clean regression test covering both the automated reservation notice and the human reviewer comment message shapes.
This comment was marked as duplicate.
This comment was marked as duplicate.
Sorry, something went wrong.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
security@apache.orgCVE bookkeeping sender defaultType of change
Test plan
uv run --project tools/security-management pytest tools/security-management/tests/test_issue_import.py— 50 passeduv run --project tools/security-management ruff check tools/security-management/tests/test_issue_import.pygit diff --checkprek run --all-files— CI will run the full repository gateRFC-AI-0004 compliance
Linked issues
Closes #1735
Notes for reviewers
If an ASF adopter supplies reviewer addresses, setup writes a complete project-level list containing both
security@apache.organd those addresses. This matters because project configuration replaces rather than merges with the organization default.AI assistance disclosure: this change was prepared with Codex and manually reviewed and tested before submission.