Repository navigation
Keep a private project board in sync with the triaged advisories - #26
Merged
Merged
Conversation
alexandre-daubois
force-pushed
the
board/sync
branch
2 times, most recently
from
October 29, 2026 10:13
a1580ab to
35ab24a
Compare
With `project` set, each triaged advisory gets a draft item on a private organisation project, with its priority, the severity the model estimates, the oldest exact duplicate and the advisory state. Advisories commented before the board existed are triaged again for it without a new comment, and every run mirrors the advisory states and recounts the duplicates without calling the model.
The draft body now holds the advisory link then the triage comment, updated through GraphQL since the REST API cannot edit a draft. Items record whether a policy exclusion applies and whether the faulty statement was located, so every sync ranks each triage again and a new priority rule needs no model run. Analysis statuses replace the manual triage priority: pending while a backfill runs, failed with or without a retry to come, each explained in the draft body.
…equiring privileges
…extension the report targets
…ates as sub-issues
…private issues from App tokens, and use made-up identifiers in the tests
Only issues of the configured repository count as board issues, so a missing issues token no longer panics and unrelated issues are left alone. The last marker of an issue body wins over one quoted from model text, the installation listing refuses a token reaching more repositories than one page shows, a backfill whose final write fails is marked failed, a state change reaches the issue, and a duplicate group keeps the spelling of its original.
…attempts on the board
Without comments, an item left at Analysis pending counts as a failed attempt and is retried, up to the attempt limit. A retrying item is no longer taken for a finished triage, a duplicate is nested under its original once that one has an issue, an issue outside the issues repository never gets its body written as a draft, and a component of "." is refused. A board triage keeps its private report before the board write, and a severity without a vector is dropped.
alexandre-daubois
force-pushed
the
board/sync
branch
from
October 29, 2026 13:31
8ae6d89 to
8cfeda0
Compare
…ue, and take out one that is no longer a duplicate
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
With
projectset, each triaged advisory gets a draft item on a private organisation project, with its priority, the severity the model estimates, the oldest exact duplicate and the advisory state. Advisories commented before the board existed are triaged again for it without a new comment, and every run mirrors the advisory states and recounts the duplicates without calling the model.