lukaszlenart opened a new pull request, #1843: URL: https://github.com/apache/struts/pull/1843
ASF lists reject a `text/html` part outright. Observed on the S2-070 announcement, 2026-08-14 — two bounces from one send: ``` <[email protected]>: ezmlm-reject: fatal: Sorry, a message part has an unacceptable MIME Content-Type: 'text/html' (#5.2.3) <[email protected]>: Must be sent from an @apache.org address. ``` `[email protected]` **accepted** the same message, so the HTML advisory reached one list while another rejected it. A missing bounce is not evidence the format was right. ### What was wrong in the skill A draft created through the Gmail tool is an HTML draft whatever is passed to it — with `body` alone, Gmail still synthesises a `text/html` alternative on send, linkifies every URL into `<a href>`, and reflows the plain part. `creating-release-vote-mail` told the reader that `body` only was *"the least-bad, and is what to use"*, which is wrong: no tool argument produces a plain-text mail. The format is decided in the compose window. ### Changes **`creating-release-vote-mail`** — *Gmail mangles the links* becomes *The mail must be text/plain, and no tool argument achieves that*, with the corrected table and the deliverable stated as a three-part contract: draft with `body` and never `htmlBody`, the identical body in a file wrapped at 72 columns, and a handover that says to switch on plain-text mode, paste the file, and send from the `@apache.org` identity. Two red flags, two rationalization rows, and the template's wrap note and pre-draft checklist updated to match. **`creating-security-bulletins`** — gains the announcement step it never had, pointing at the CVE tool's *OSS/ASF Emails* tab: both mails are generated from the record, so copying them keeps the advisory and the CVE record from drifting, and the send buttons go through ASF infrastructure instead of a personal mailbox. Publication is also spelled out — clear read *and* update restrictions completely, and verify with an unauthenticated fetch rather than trusting the API's success response. Three red flags, three rationalization rows, and the description now names announcing as a trigger. ### Testing The RED phase is the production run above, with the bounce notices as artifacts. The GREEN phase — subagent scenarios confirming the new wording makes a fresh agent produce the right deliverable — has **not** been run. Not touched, and candidates for a follow-up: `creating-version-notes` produces the `[TEST]` mail with no draft-mechanics guidance, and the GA `[ANN]` mail hits `[email protected]` but is covered by no skill at all. 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
