mcpField
R
rhdh-overlay-cve-export

rhdh-overlay-cve-export

github.com/redhat-developerSecurity1944 installsUpdated 1d ago
Repository

About rhdh-overlay-cve-export

rhdh-overlay-cve-export is a skill for producing the CSV expected by RHDH CVE Management from overlay Git history. It directs users to a script for package-level CVE extraction and handles Jira enrichment separately.

Key features

  1. 01Overlay Git history extraction
  2. 02Plugin package and CVE pairing
  3. 03CSV export through a script
  4. 04Separate Jira data enrichment
  5. 05Output and completion checks

Use cases

  1. 01Preparing an RHDH CVE inventory
  2. 02Identifying plugin containers with CVE fixes
  3. 03Applying Jira fields to exported rows

Install

Copy the command and run it in a terminal.

$npx skills add https://github.com/redhat-developer/rhdh-skills --skill rhdh-overlay-cve-export

After installing, type/rhdh-overlay-cve-exportin Claude Code to confirm it loaded.

Bundled files

References and scripts installed along with SKILL.md.

agents/
openai.yaml
references/
overlay-cve-csv-format.md
overlay-cve-sources.md
scripts/
compute-plugin-package-overlay-cve-list.mjs
tests/
compute-plugin-package-overlay-cve-list.test.mjs
workflows/
overlay-cve-export.md

Details

From the project README

Plugin overlay CVE export

Turn overlays git history into the CSV that RHDH CVE Management expects: one row per CVE and affected plugin package, scoped to generally-available workspaces.

This is a package-inventory job, not release reporting. It answers "which plugin containers carry which CVE fix", from git — not "how is the release doing", which is /rhdh-release-status.

Route

Load workflows/overlay-cve-export.md. It covers the extract run, Jira enrichment, and the flag set.

Two references belong to this workflow alone and are read on demand:

  • references/overlay-cve-csv-format.md — the exact header, the row rule, the Container column, and the default output path.
  • references/overlay-cve-sources.md — which workspaces and commits count, how CVEs and Jira keys are extracted, and how --since resolves.

Do not reimplement the parsing

scripts/compute-plugin-package-overlay-cve-list.mjs owns commit selection, CVE extraction, pairing, dedupe, and CSV shape. Run it. Reading the overlays repo by hand and assembling rows in chat produces a different answer than the export the CVE process is checked against.

The script never calls Jira. Enrichment is a separate pass: invoke /rhdh-jira-api for the issue fields, write them to a JSON file, and feed that back through --apply-enrich.

Writing rules

The extract itself only clones and reads. Writing the enrichment JSON and the final CSV creates files on the user's disk — say where they will land and get agreement before the run that writes them. Never commit the CSV into a repository, and never post it anywhere.

Completion

Complete when the CSV path is named, the row count is stated, and the --since revision the script actually resolved is reported rather than the version string that was asked for. Every CVE without a Jira issue is listed with the overlays commit URL that stands in for it. CVSS appears only where a ProdSec CVSS field supplied it — a blank CVSS column is the correct output, never a filled-in guess. Rows dropped by the --jql filter are counted, so the user can tell an empty result from a filtered one. No credential or OAuth secret appears in any output.

Comments

Markdown supported