Repository navigation
Conversation
…edup Add pre-Step-8 release Jira orchestration (Step 7.5) that finds or creates a release Epic and release Task for the affected stream, with cross-CVE dedup to skip task creation when an existing remediation Task already covers the same Upstream Affected Component. Add dependency bump remediation template for cargo update/npm update fixes as a distinct variant from upstream backport, used when Step 2.5 confirms the upstream branch already ships the fixed version. Update discovery mode to include a release Jira summary showing remediation progress per release. Implements TC-6724 Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> Assisted-by: Claude Code
Contributor
Reviewer's GuideAdds a confirmed release Epic/Task orchestration layer around security triage, deduplicates remediation across CVEs sharing an upstream component, and introduces dependency-bump remediation templates while updating discovery reporting, workflow branching, Jira links, and summaries. Sequence diagram for release Jira orchestration and CVE deduplicationsequenceDiagram
participant Engineer
participant Triage as Security_Triage
participant Jira
Engineer->>Triage: Start triage
Triage->>Jira: search_jql release Epic
alt Release Epic missing
Triage->>Engineer: Confirm version
Engineer-->>Triage: Accept or specify version
Triage->>Jira: jira.create_issue release Epic
end
Triage->>Jira: search_jql release Task
alt Release Task missing
Triage->>Engineer: Confirm Task creation
Engineer-->>Triage: Confirm or skip
Triage->>Jira: jira.create_issue release Task
end
Triage->>Jira: jira.get_issue release Task with issuelinks
Triage->>Jira: jira.get_issue linked remediation Tasks
alt Existing Task covers upstream component
Triage->>Jira: jira.create_link CVE to existing Task
Triage->>Jira: jira.create_link CVE to release Task
Triage->>Jira: jira.edit_issue add CVE label
else No existing coverage
Triage->>Jira: jira.create_issue remediation Tasks
Triage->>Jira: jira.create_link Tasks to release Task
Triage->>Jira: jira.create_link CVE to release Task
end
Flow diagram for release orchestration and cross-CVE deduplicationflowchart TD
TRIAGE["Concurrent triage complete"] --> RELEASE["Resolve release version"]
RELEASE --> EPIC{"Release Epic exists?"}
EPIC -->|Yes| TASK["Find release Task"]
EPIC -->|No| CONFIRM_EPIC["Confirm version with engineer"]
CONFIRM_EPIC --> CREATE_EPIC["jira.create_issue"]
CREATE_EPIC --> TASK
TASK --> TASK_EXISTS{"Release Task exists?"}
TASK_EXISTS -->|Yes| DEDUP["Inspect linked remediation Tasks"]
TASK_EXISTS -->|No| CONFIRM_TASK["Confirm Task creation"]
CONFIRM_TASK --> CREATE_TASK["jira.create_issue"]
CREATE_TASK --> DEDUP
DEDUP --> MATCH{"Same upstream component covered?"}
MATCH -->|Yes| LINK_EXISTING["jira.create_link and jira.edit_issue"]
MATCH -->|No| REMEDIATION["Create remediation Tasks"]
REMEDIATION --> RELEASE_LINK["Link remediation Tasks to release Task"]
File-Level Changes
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Hey - I've found 1 issue
Prompt for AI Agents
Please address the comments from this code review:
## Individual Comments
### Comment 1
<location path="plugins/sdlc-workflow/skills/triage-security/jira-triage-operations.md" line_range="621-627" />
<code_context>
+ check if its summary or description references the same upstream component
+ as the current CVE. Two matching strategies:
+
+ a. **Component field match** (primary): if the linked Task's labels include the
+ same component label (matching the Component label pattern from Security
+ Configuration, e.g., `pscomponent:org/repo`), it covers the same component.
+ b. **Summary fallback**: if the linked Task's summary contains the same library
+ name as the current CVE's vulnerable library (from Step 1), it covers the
+ same component.
+
+4. **If a covering remediation Task is found:**
+
</code_context>
<issue_to_address>
**issue (bug_risk):** The primary dedup strategy looks for the upstream component in remediation-task labels, but the new remediation task creation examples only add `ai-generated-jira`, `Security`, and the CVE ID; they do not add the component label or populate a task component field. Dedup therefore falls back to a library-name substring match, which both misses tasks whose summaries use different naming and incorrectly merges unrelated repositories or forks sharing a library name.
**Triggers:** When an existing remediation task lacks an exact component label and another component uses the same library name.
**Suggested fix:** Persist the exact Upstream Affected Component on every remediation task, and compare that value rather than using an unqualified library-name substring fallback.
</issue_to_address>Sourcery assessment
Needs a human reviewer. 1 finding to address first, and a false-positive cross-CVE match based on a component label or library name could skip creation of the remediation tasks needed for a vulnerability, leaving it associated with a task that does not fix it. Reverting the workflow instructions would not recreate any remediation task that was missed, so the gap requires manual repair.
Blocking findings: plugins/sdlc-workflow/skills/triage-security/jira-triage-operations.md:627
…atching Replace label/summary matching in Step 7.5.3 with Depend-link traversal: resolve each remediation Task's parent CVE via Depend links, then compare Upstream Affected Component (customfield_10632) values. Summary matching retained only as fallback when the Depend link or field is missing. Implements TC-6724 Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> Assisted-by: Claude Code
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Eval Results
Eval Results: triage-security
| Eval | Passed | Failed | Pass Rate |
|---|---|---|---|
| eval-1 | 11/11 | 0 | 100% |
| eval-2 | 5/5 | 0 | 100% |
| eval-3 | 5/5 | 0 | 100% |
| eval-4 | 5/5 | 0 | 100% |
| eval-5 | 6/6 | 0 | 100% |
| eval-6 | 5/6 | 1 | 83% |
| eval-7 | 5/5 | 0 | 100% |
| eval-8 | 8/8 | 0 | 100% |
| eval-9 | 5/5 | 0 | 100% |
| eval-10 | 5/5 | 0 | 100% |
| eval-11 | 5/5 | 0 | 100% |
| eval-12 | 5/5 | 0 | 100% |
| eval-13 | 5/5 | 0 | 100% |
| eval-14 | 5/5 | 0 | 100% |
| eval-15 | 5/5 | 0 | 100% |
| eval-16 | 7/7 | 0 | 100% |
| eval-17 | 5/5 | 0 | 100% |
| eval-18 | 5/5 | 0 | 100% |
| eval-19 | 5/5 | 0 | 100% |
| eval-20 | 4/4 | 0 | 100% |
| eval-21 | 4/4 | 0 | 100% |
| eval-22 | 4/4 | 0 | 100% |
| eval-23 | 4/4 | 0 | 100% |
| eval-24 | 4/4 | 0 | 100% |
| eval-25 | 4/4 | 0 | 100% |
| eval-26 | 5/5 | 0 | 100% |
| eval-27 | 5/5 | 0 | 100% |
| eval-28 | 5/5 | 0 | 100% |
| eval-29 | 5/5 | 0 | 100% |
| eval-30 | 4/4 | 0 | 100% |
| eval-31 | 4/4 | 0 | 100% |
| eval-32 | 4/4 | 0 | 100% |
Failed Assertions
eval-6: 1 failing assertion
- Assertion: "Each listed issue shows: issue key, status, CVE ID (from labels), summary, and created date"
Evidence: "Query 1 and Query 2 tables include all five fields (Issue, Status, CVE ID, Summary, Created) for all issues. However, Query 3's filtering analysis table for TC-9023 and TC-9026 only shows Issue, Status, and CVE ID — missing Summary and Created columns. While status-handling.md provides Summary for TC-9023 ('rustls - Certificate validation bypass') and TC-9026 ('openssl - Buffer overflow in X.509 parsing'), neither file provides a Created date for TC-9023 or TC-9026 anywhere in the outputs."
Pass rate: 99% · Tokens: 86,813 · Duration: 139s
Generated by sdlc-workflow/run-evals v0.13.9
Collaborator
Author
|
[sdlc-workflow/verify-pr] Re: @sourcery-ai[bot] review — Classified as code change request — the dedup strategy concern was addressed in commit fb7d9ee, which replaced label/summary matching with Depend-link traversal comparing Upstream Affected Component (customfield_10632) values on parent CVEs. No sub-task created. |
Collaborator
Author
Verification Report for TC-6724 (commit fb7d9ee)
Overall: WARNeval-20 has 3 regression failures caused by a hardcoded This comment was AI-generated by sdlc-workflow/verify-pr v0.13.9. |
…ic staleness check Add "treat today's date as 2026-06-29T10:00:00Z" instruction to eval-20 prompt so the staleness check against the fixture's Last-Updated timestamp (2026-06-28) always computes 1 day old, well within the 14-day threshold. This prevents the 3 assertion failures caused by the hardcoded fixture date aging past the threshold over time. Implements TC-6725 Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> Assisted-by: Claude Code
Collaborator
Author
Verification Report for TC-6724 (commit be9508f)
Overall: PASSScope Containment WARN is informational — extra file is from sub-task TC-6725 (eval fixture fix), not untracked scope creep. All acceptance criteria met, CI green, eval pass rate improved from 97% to 99%. This comment was AI-generated by sdlc-workflow/verify-pr v0.13.9. |
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
cargo update/npm updatefixes, distinct from upstream backport (used when upstream already ships the fix)Implements TC-6724
Implements TC-6725
Test plan
🤖 Generated with Claude Code