From aa576c21e7f7f9ff2cd74c18163fae076b0fdbe9 Mon Sep 17 00:00:00 2001 From: Jarek Potiuk Date: Sat, 1 Aug 2026 14:29:09 +0200 Subject: [PATCH] fix(docs): point at the config key that exists MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Both places telling an agent how to resolve `` named `mailing_lists.security`, which is not a key anywhere in the tree. The adopter manifest declares `security_list` under a `## Mailing lists` heading, so an agent following either instruction would look for a key that does not exist and be unable to resolve the placeholder. - `AGENTS.md` § Placeholder convention — the source column for ``. - `skills/security-cve-allocate/SKILL.md` — the resolution block, where the sibling entries already use the flat form (`tracker_repo:`, `upstream_repo:`) and this one was the odd one out. Its arrow was also misaligned by a space against the entries around it; fixed while there. Verified against `projects/_template/project.md`: `security_list`, `private_list`, `users_list`, `dev_list`, `announce_list`, `commits_list` are the declared keys. Every other placeholder the table cites — `tracker_repo`, `upstream_repo`, `upstream_default_branch` — does resolve, so this was an isolated error rather than a pattern. Not touched, deliberately: `skills/security-issue-sync/github-advisory.md` uses `` for the *org-level* advisory-admin address and `` for the project list, in the same sentence. They are different addresses, so collapsing them would turn "email X, CC the project list" into "email X, CC X". The org-level address has no single agreed name — `` here, `` in AGENTS.md, and `security_inbox.foundation_security_address` as the actual org-level config path — which wants deciding on its own, not guessing at inside a typo fix. Filed separately. Generated-by: Claude Code (Opus 5) --- AGENTS.md | 2 +- skills/security-cve-allocate/SKILL.md | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/AGENTS.md b/AGENTS.md index 27ad92c6..cf841daa 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -360,7 +360,7 @@ configuration before executing any command: | `` | The framework root — `.apache-magpie/` (the gitignored snapshot) in adopting projects, `.` in framework standalone. Used in `uv run` and other invocations that address the framework's `tools//` subtrees. | Filesystem convention. | | `` | GitHub slug of the (security) tracker repo (example: `airflow-s/airflow-s`). | `/project.md` → `tracker_repo` | | `` | GitHub slug of the upstream codebase the fixes land in (example: `apache/airflow`). | `/project.md` → `upstream_repo` | -| `` | The project's security mailing list (example: `security@airflow.apache.org`). | `/project.md` → `mailing_lists.security` | +| `` | The project's security mailing list (example: `security@airflow.apache.org`). | `/project.md` → `security_list` (under **Mailing lists**) | | `` | URL of the project's general-issue tracker, distinct from the security tracker. | `/issue-tracker-config.md` → `url` | | `` | Project key within the issue tracker (JIRA key or `owner/repo`). | `/issue-tracker-config.md` → `project_key` | | `` | Recipe for invoking the project's runtime on a single source file. | `/runtime-invocation.md` | diff --git a/skills/security-cve-allocate/SKILL.md b/skills/security-cve-allocate/SKILL.md index c52185dc..8b2e4582 100644 --- a/skills/security-cve-allocate/SKILL.md +++ b/skills/security-cve-allocate/SKILL.md @@ -32,7 +32,7 @@ license: Apache-2.0 (example: ``) → value of `upstream_repo:` in /project.md (example: ``) - → value of `mailing_lists.security:` in /project.md + → value of `security_list:` in /project.md (example: ``) → the CVE-tool adapter directory selected by `cve_authority.tool:` in /project.md