Repository navigation
Advisory Creation WORKFLOW Loose-Ends #1133
Description
Advisory Creation WORKFLOW Loose-Ends
- AUTOMATED or PRE-CHECK
- Redo PR#1079 (Add
titleanddescriptionlline length check) (UPDATE: PR#1135/Canceled/Deferrred) - Check for more automated field checks.
- Future of
kwalifygem (Keep for now)
- Redo PR#1079 (Add
- MANUAL STEPS
- Add non-GHSA
cvssfields/values from https://nvd.nist.gov/vuln . - Add more references to support all the data. Suggest adding project-related evidence as references to prove the patch, such as Rubygem link, CHANGELOGs, Release Notes, project blog posts.
- Check for dead URLs. (mostly for legacy advisories) (all URLs on new internal created advisories are checked).
- Add non-GHSA
NOTE: Expect to keep current for now.
Metadata
Metadata
Assignees
Labels
No labels
Activity
jasnow commentedon Jun 22, 2026
Should we add ML for PR reviews?
[-]Advisory Upfront WORKFLOW Loose-Ends[/-][+]RAD Advisory Creation WORKFLOW Loose-Ends[/+]jasnow commentedon Jun 23, 2026
FYI: Advisories are getting longer description field with more sections.
Probably need to flag ## Details section etc just like POC.
[-]RAD Advisory Creation WORKFLOW Loose-Ends[/-][+]Advisory Creation WORKFLOW Loose-Ends[/+]jasnow commentedon Jul 9, 2026
Checked EUVD database this morning for "ruby" or "rubygem" advisories - found 33 - already had 21 - looks at the 12 "new" - 4 really there and 8 "not gems".
jasnow commentedon Jul 14, 2026
Currently checking gem projects' "security/advisories" for missing advisories.
jasnow commentedon Jul 28, 2026
Yesterday found GHSL advisories yesteray - see PR#1187 for details
jasnow commentedon Aug 2, 2026
Getting tired of touching advisories twice when filenames changes. 22 days before my version and global GHSA version.