Compute plugin package overlay CVE list

Goal

Produce a unique CVE list (CSV matching RHDH CVE Management exports) for dependency/CVE fixes on a release branch since a revision, scoped to generally-available plugin workspaces.

Primary repo: rhdh-plugin-export-overlays.

Prerequisites

• Node 18+, git, gh
• For Jira enrich (default): Cursor Atlassian MCP (plugin-atlassian-atlassian) — run cursor-mcp-auth first
• Optional local --rhdh-repo for --since date fallback

Do not reimplement parsing — run the bundled script. The CLI does not call Jira; the agent enriches via MCP.

Run (extract)

SKILL=skills/compute-plugin-package-overlay-cve-list   # under 1-rhdh-skill checkout
node "${SKILL}/scripts/compute-plugin-package-overlay-cve-list.mjs" \
  --since 1.10.2 \
  --regex 'orchestrator|lightspeed' \
  --repo /home/nboldt/1/1-overlays
# Default: /tmp/1.10/RHDH CVE Management - 1.10.3-plugins.csv
#          /tmp/1.10/RHDH CVE Management - 1.10.3-plugins.rows.json

--since 1.10.2 alone implies --branch release-1.10. Omit --repo to clone overlays into /tmp/rhdh-plugin-export-overlays-<timestamp>.

Agent enrich (default)

Unless --no-metadata:

1. Load cursor-mcp-auth → ok:mcp (atlassianUserInfo).
2. cloudId: 2b9e35e3-6bd3-4cec-b838-f4249ee02432 or https://redhat.atlassian.net.
3. For each unique JIRA key (or bulk JQL) → MCP getJiraIssue / searchJiraIssuesUsingJql with fields: summary, status, resolution, duedate, customfield_10859 (ProdSec CVSS vector; take leading score, e.g. 7.5 from 7.5 CVSS:3.1/...). Use issueFieldsToEnrich from the script.
4. For CVEs with no JIRA → MCP searchJiraIssuesUsingJql: project IN (RHIDP,RHDHBUGS,RHDHPLAN) AND summary ~ "CVE-…" AND (<jql>)
--jql is an inclusion rule. Default Resolution != null → MCP resolution is not EMPTY.
5. Write enrich JSON, then apply (same --jql keeps matching rows in the CSV):

# enrich.json shape:
# { "issues": { "RHIDP-123": { "status","resolution","dueDate","cvss","summary" } },
#   "cveJiras": { "CVE-2026-1": ["RHIDP-456"] } }

node "${SKILL}/scripts/compute-plugin-package-overlay-cve-list.mjs" \
  --apply-enrich /tmp/1.10/enrich.json \
  --rows-json "/tmp/1.10/RHDH CVE Management - 1.10.3-plugins.rows.json" \
  -o "/tmp/1.10/RHDH CVE Management - 1.10.3-plugins.csv"

Never invent CVSS — only use the leading score from customfield_10859 (or another explicit CVSS field). Never paste OAuth secrets into chat.

Flags

References

• csv-format.md
• sources.md

Gotchas

• Overlays may lack version tags — --since X.Y.Z uses the tip-most branch commit mentioning that version (release message or resolve X.Y.Z CVEs), not an earlier release-message alone
• CVE tracking is GA-only (spec.support: generally-available)
• Skip test-only commits (e2e-tests/, smoke-tests/)
• Enrich via Atlassian MCP after extract (--apply-enrich)
• If no JIRA for a CVE, JIRA Issue column gets the overlays commit URL
• Unchanged / prior-release backport CVEs → Resolution Done <since>, Status Closed <since> (e.g. Done 1.10.2 / Closed 1.10.2); JIRA from introduce commit PR