This is an automated email from the ASF dual-hosted git repository.
mridulpathak pushed a commit to branch trunk
in repository https://gitbox.apache.org/repos/asf/ofbiz-framework.git
The following commit(s) were added to refs/heads/trunk by this push:
new fac9b4c8bf Improved: Group the security fixes and security hardening
in the release notes (OFBIZ-13696)
fac9b4c8bf is described below
commit fac9b4c8bf2c0fc8acae6ebd75eeb8d8be4dd9fc
Author: Mridul Pathak <[email protected]>
AuthorDate: Wed Oct 21 14:33:34 2026 +0530
Improved: Group the security fixes and security hardening in the release
notes (OFBIZ-13696)
Pull requests labeled cve are listed under Security fixes and the other
pull requests labeled security under Security hardening, ahead of the type
categories since a pull request is listed in the first category whose labels
match. The labels are set by hand, cve only once the CVE is announced, after
which the release notes can be generated again.
---
.github/README-CI-CD.md | 2 ++
.github/release.yml | 10 ++++++++++
2 files changed, 12 insertions(+)
diff --git a/.github/README-CI-CD.md b/.github/README-CI-CD.md
index e4a1ff6f1a..b811037ac9 100644
--- a/.github/README-CI-CD.md
+++ b/.github/README-CI-CD.md
@@ -47,6 +47,8 @@ New branches inherit workflow files from `trunk` at creation
time.
`release.yml` configures the release notes GitHub generates: PRs are grouped
by their type label, and Dependabot PRs and PRs labeled `dependencies` are left
out.
+PRs labeled `cve` are listed under Security fixes and the other PRs labeled
`security` under Security hardening. These labels are set by hand: `cve` only
once the CVE is announced, then the release notes of the release can be
generated again, and `security` by the committer for security hardening without
a CVE.
+
GitHub reads `release.yml` from the tag being released, so it must be on the
release branch before the tag is created.
To label the PRs merged before `pr-type-label.yml` existed, run it manually
from the Actions tab with the date of the previous release, first as a dry run.
diff --git a/.github/release.yml b/.github/release.yml
index fc7940b217..bcf841122d 100644
--- a/.github/release.yml
+++ b/.github/release.yml
@@ -21,6 +21,10 @@
# GitHub reads this file from the tag being released, so it has to be on the
# release branch before the tag is cut.
# The type labels are set from the PR title prefix by pr-type-label.yml.
+# The cve and security labels are set by hand, cve only once the CVE is
+# announced, after which the release notes can be generated again.
+# A pull request is listed in the first category whose labels match, so the
+# security categories come before the type categories.
# See
https://docs.github.com/en/repositories/releasing-projects-on-github/automatically-generated-release-notes
changelog:
@@ -30,6 +34,12 @@ changelog:
authors:
- dependabot[bot]
categories:
+ - title: Security fixes
+ labels:
+ - cve
+ - title: Security hardening
+ labels:
+ - security
- title: Bug fixes
labels:
- bug
