potiuk opened a new pull request, #3:
URL: https://github.com/apache/airflow-steward/pull/3

   ## Summary
   
   PR 2 ported the `generate-cve-json` Python implementation into the 
framework. Skills currently invoke it via `uv run --project 
tools/vulnogram/generate-cve-json …` — works in framework standalone (cwd=repo 
root), but **not** in adopting projects, where the framework lives at the 
`.apache-steward/apache-steward/` submodule path.
   
   This PR introduces a `<framework>` placeholder. Adopting projects substitute 
it to `.apache-steward/apache-steward/`; framework-standalone substitutes to 
`.`. Skills now reference `<framework>/tools/vulnogram/generate-cve-json` 
everywhere they invoke the tool, and the path resolves in either context after 
the agent's standard placeholder substitution.
   
   ## Files updated
   
   - **AGENTS.md** — new row in the placeholder-convention table for 
`<framework>`.
   - 
**.claude/skills/{sync-security-issue,allocate-cve,deduplicate-security-issue}/SKILL.md**
 — 6 invocation sites updated.
   - **tools/vulnogram/generate-cve-json/SKILL.md** — 3 invocation sites 
updated.
   - **tools/vulnogram/generate-cve-json/README.md** — documented the 
dual-context invocation with the placeholder.
   
   ## Files NOT changed
   
   Markdown links to SKILL.md (e.g. 
`[generate-cve-json](../../../tools/vulnogram/generate-cve-json/SKILL.md)`) — 
those work via the `.claude/skills/` symlink in adopters because the kernel 
follows the symlink to the file's actual location and resolves the relative 
path from there.
   
   ## Test plan
   
   - ✅ Pre-commit passes (ruff/mypy/pytest + standard hooks).
   - ✅ All 100 tests in the generate-cve-json package pass.
   - [ ] Future: dogfood a sync run in airflow-s once this lands and the 
submodule is bumped.
   
   ## Coordination
   
   This is the framework-side counterpart to [airflow-s/airflow-s#363 
(`delete-local-cve-json-after-port`)](https://github.com/airflow-s/airflow-s/pull/363).
 After this PR lands, airflow-s PR 3 needs one more commit to bump the 
submodule pointer to this PR's merge SHA — only then do skills work end-to-end 
on airflow-s.
   
   🤖 Generated with [Claude Code](https://claude.com/claude-code)


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: [email protected]

For queries about this service, please contact Infrastructure at:
[email protected]


---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]

Reply via email to