Repository navigation
refactor(archive): look up advisory URLs through the configured archive - #1906
Conversation
github-actions
Bot
added
family:security
Kaap10
left a comment
Kaap10
left a comment
There was a problem hiding this comment.
Thanks @Anurag-S1ngh for the PR. This cleanly addresses #1801 by decoupling the public advisory URL resolution from PonyMail assumptions.
Introducing archive_system.advisory_thread_url_template with the PonyMail URL as the ASF organization default allows projects hosted on Mailman, groups.io, or other public archives to construct their permalinks without hardcoded ASF assumptions.
The backwards compatibility fallback to the legacy ponymail_thread_url_template key ensures existing adopter project configurations continue working without manual intervention, and keeping the advisory-archive gate checks intact maintains our release verification standards.
Left a couple of small non-blocking suggestions inline regarding template variable naming and project template table alignment.
potiuk
left a comment
potiuk
left a comment
There was a problem hiding this comment.
Routing the advisory-URL lookup through the configured archive is the right direction. Three small points came up in review, so I pushed a fixup commit (4169341) to your branch rather than send it back:
organizations/ASF/organization.mdandplugins/magpie-setup/templates/project.md: the permalink template now ends in?{list}@{list_domain}. In the samearchive_systemblock,api_query_url_templateuses{list}for the list's local part, so?{list}would have rendered?usersinstead of the full-address permalink trackers store and the CVE record publishes as itsvendor-advisoryreference.plugins/magpie-security/skills/issue-sync/signals-to-actions.md: when neither URL template is declared (theindependentbaseline), the step now says to use the archive's own permalink or ask the release manager, never to construct one; and the confirmation step names the legacyponymail_thread_url_templatetoo, matching the lookup step.
One point for a follow-up rather than this PR: the mail-archive contract already has resolve_advisory_announcement_url(list, advisory_id) for exactly this step (tools/mail-archive/README.md), so the non-PonyMail path could call that verb instead of branching on archive_system.kind, which would also send kind: none straight to "ask the release manager". Please pull before pushing again.
This review was drafted by an AI-assisted tool and
confirmed by an Apache Magpie maintainer. The maintainer
approving this PR has read the findings and signed off. If
something feels off, please reply on the PR and a maintainer
will follow up.More on how Apache Magpie handles maintainer review:
Contributing guide.
Why: the advisory-URL step built its link from the PonyMail-only ponymail_thread_url_template, so a project on another archive had no template to use. Declare advisory_thread_url_template in the archive system, keep the ASF value as the default, and document the override.
Why: the step told every project to use the PonyMail MCP or HTTP API, so an adopter on another archive could not find its published advisory. Keep the PonyMail recipe as the ASF default and add the archive-agnostic path through search_url_template and advisory_thread_url_template, falling back to the legacy PonyMail template when that is all the project declares.
Why: the ASF organization declares advisory_thread_url_template with
{thread_id} and {list}, but the setup template still documented the
legacy PonyMail key with the older <hash> spelling, and the
quick-reference table listed only the legacy key, so adopters reading
the table never saw the generic one.
Generated-by: OpenCode (DeepSeek V4.1 Flash)
In the same archive_system block, {list} is the list's local part
(api_query_url_template pairs it with {list_domain}), so ?{list} would
have rendered ?users instead of the full-address permalink trackers store
and the CVE record publishes. Spell ?{list}@{list_domain} in the ASF
organization and the project template.
Tell issue-sync what to do when neither URL template is declared (use the
archive's permalink or ask the release manager), and keep the legacy key
in the confirmation step consistent with the lookup step.
Generated-by: Claude Opus 5
4169341 to
eb6a22f
Compare
Summary
archive_system.advisory_thread_url_template, with the ASF PonyMail URL as the default, so a project on another public archive can build its advisory permalink.search_url_templateplus the new template; the legacyponymail_thread_url_templatestill works.advisory-archivegate unchanged, so the list, root subject, sender, and host checks still decide whether the URL may be proposed.Fixes #1801
Test plan
prek run --all-files --skip workspace-pytest: all hooks pass