Repository navigation
fix: link the issue chooser to private vulnerability reporting and the right repository - #474
Merged
Merged
Conversation
SECURITY.md asks reporters to use private vulnerability reporting, but the issue chooser only listed Discussions and the documentation, so a reporter found the private form only by opening SECURITY.md first. Add a contact link to /security/advisories/new at the top of contact_links, built from project_slug as SECURITY.md is. Backported from stateful-y/kedro-dagster#249.
The Discussions and Documentation links were built from package_name, so any project whose name has a separator linked a repository that does not exist (stateful-y/yohou_optuna) and a GitHub Pages site the template does not deploy. Use project_slug, as SECURITY.md and the README do, and the Read the Docs URL that mkdocs.yml, pyproject.toml and CITATION.cff already point to.
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
8 of 17 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Two changes to the generated
.github/ISSUE_TEMPLATE/config.yml:/security/advisories/new. Backported from docs: Offer private vulnerability reporting in the issue chooser kedro-dagster#249.project_sluginstead ofpackage_name. The Documentation link now points to Read the Docs instead of GitHub Pages.Type of Change
Motivation and Context
SECURITY.mdasks reporters to use private vulnerability reporting, but the issue chooser didn't offer it. A reporter who went straight to "New issue" never saw the private form.project_slug, includingSECURITY.md, the README andCITATION.cff. Every docs link points to{{ project_slug }}.readthedocs.io:mkdocs.yml,pyproject.toml,CITATION.cffand the README. Building the issue chooser links frompackage_namebreaks them in any project whose name has a separator. Today, sklearn-optuna, yohou-mlflow, yohou-nixtla and yohou-optuna link to repositories that don't exist (for examplestateful-y/yohou_optuna/discussions) and to GitHub Pages sites that aren't deployed. All of these projects publish their docs on Read the Docs.How Has This Been Tested?
uv run pytest: the fast suite gives 478 passed, 1 skippedcopiefixture)New tests, each confirmed to fail without its template change:
tests/test_security_hardening.py::test_issue_chooser_offers_private_vulnerability_reporting: the link renders, matches the one inSECURITY.md, and comes before Discussions.tests/test_template.py::test_issue_chooser_links_use_the_repository_slug: Discussions and docs links use the slug and Read the Docs, and the package name doesn't appear in them.Checklist
Additional Notes
After the next release, a template update in each repo adjusts this file. kedro-dagster already has the security link from #249 and correct local links for the other two.
Generated by Claude Code