Advisory Creation WORKFLOW Loose-Ends

[jasnow]

Advisory Creation WORKFLOW Loose-Ends

• AUTOMATED or PRE-CHECK
  • Redo PR#1079 (Add title and description lline length check) (UPDATE: PR#1135/Canceled/Deferrred)
  • Check for more automated field checks.
  • Future of kwalify gem (Keep for now)
• MANUAL STEPS
  • Add non-GHSA cvss fields/values from https://nvd.nist.gov/vuln .
  • Add more references to support all the data. Suggest adding project-related evidence as references to prove the patch, such as Rubygem link, CHANGELOGs, Release Notes, project blog posts.
    • Good example: https://github.com/rubysec/ruby-advisory-db/blob/master/gems/excon/CVE-2026-54171.yml
  • Check for dead URLs. (mostly for legacy advisories) (all URLs on new internal created advisories are checked).

NOTE: Expect to keep current for now.

[jasnow]

Should we add ML for PR reviews?

• https://simianwords.bearblog.dev/you-should-use-ai-for-reviewing-code-especially-when-the-diff-is-huge/

[jasnow]

FYI: Advisories are getting longer description field with more sections.
Probably need to flag ## Details section etc just like POC.

[jasnow]

Checked EUVD database this morning for "ruby" or "rubygem" advisories - found 33 - already had 21 - looks at the 12 "new" - 4 really there and 8 "not gems".

[jasnow]

Currently checking gem projects' "security/advisories" for missing advisories.

[jasnow]

Yesterday found GHSL advisories yesteray - see PR#1187 for details

• Found 1 non-gem advisory - updated rad-ignores.sh file.
• Added to 5 existing advisories.
• Skipped 3 GHSL advisories because of unclear release.

[jasnow]

Getting tired of touching advisories twice when filenames changes. 22 days before my version and global GHSA version.