Add a roller-security developer skill for report triage and coordination - #187
Merged
Merged
Conversation
snoopdave
added a commit
that referenced
this pull request
Sep 11, 2026
#186) * Add a roller-release developer skill documenting the release procedure Adds an optional skills/ directory holding written-down project procedures for Roller developers, starting with the release workflow: preparing and versioning a candidate, building, signing, verifying, staging, voting, promoting the approved bytes, updating the website and announcing. The skill is plain Markdown plus two helper scripts. It is not part of the build, the runtime, or the source and binary distributions; the source assembly's include list does not cover this directory. Developers who use an agent tool can symlink it under .claude/skills/, and everyone else can read it as documentation. See skills/README.md. The helpers preview by default and never commit, tag, push, sign or send mail. The skill records procedure only; the PMC owns release decisions and ASF policy governs what a release requires. Claude-Session: https://claude.ai/code/session_015X69HHQ5XnjRkJP8ymzwFf * Add a roller-security developer skill for report triage and coordination (#187)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds an optional Roller security-response skill with generic guidance, blank private-case templates, and helpers for tracking, migration, and disclosure linting. Obsidian integration is optional; the PMC retains case, release, and disclosure decisions. Project-specific coordination and reporter-review guidance are included for PMC review.
The disclosure linter requires explicit commit-range endpoints, rejects malformed or unknown revisions, and reports Git failures instead of treating them as a clean scan.
Stacked on #186: this PR adds only
roller-securityand its README table entry. Merge #186 first, then retarget this PR tomaster.Validation: shell/Python syntax, local Markdown links, ASF headers, and publication-content scans passed. Twelve isolated behavioral cases passed for range handling, including exclusion of historical flagged commits. Earlier preparation covered tracking/migration helpers; the latest bundled metadata-validator attempt was blocked by missing PyYAML. No application build was run because the skill is outside the build and distribution allowlist.