| name | rhdh-overlay-cve-export |
| description | Builds the "RHDH CVE Management - <version>-plugins.csv" export by walking `rhdh-plugin-export-overlays` git history on a release branch since a revision, scoped to generally-available plugin workspaces, then enriching each CVE from Jira RHIDP, RHDHBUGS, and RHDHPLAN. Use for "generate the plugin overlay CVE CSV for 1.10.3", "what CVEs were fixed in plugins since 1.10.2", or "rebuild the plugin CVE list with the ProdSec CVSS scores". |
| compatibility | Node 18+, git, and gh; a checkout or clone of rhdh-plugin-export-overlays; /rhdh-jira-api for CVE enrichment. |
Plugin overlay CVE export
Turn overlays git history into the CSV that RHDH CVE Management expects: one row
per CVE and affected plugin package, scoped to generally-available workspaces.
This is a package-inventory job, not release reporting. It answers "which plugin
containers carry which CVE fix", from git — not "how is the release doing", which
is /rhdh-release-status.
Route
Load workflows/overlay-cve-export.md. It covers the extract run, Jira
enrichment, and the flag set.
Two references belong to this workflow alone and are read on demand:
references/overlay-cve-csv-format.md — the exact header, the row rule, the
Container column, and the default output path.references/overlay-cve-sources.md — which workspaces and commits count, how
CVEs and Jira keys are extracted, and how --since resolves.
Do not reimplement the parsing
scripts/compute-plugin-package-overlay-cve-list.mjs owns commit selection, CVE
extraction, pairing, dedupe, and CSV shape. Run it. Reading the overlays repo by
hand and assembling rows in chat produces a different answer than the export the
CVE process is checked against.
The script never calls Jira. Enrichment is a separate pass: invoke /rhdh-jira-api
for the issue fields, write them to a JSON file, and feed that back through
--apply-enrich.
Writing rules
The extract itself only clones and reads. Writing the enrichment JSON and the
final CSV creates files on the user's disk — say where they will land and get
agreement before the run that writes them. Never commit the CSV into a
repository, and never post it anywhere.
Completion
Complete when the CSV path is named, the row count is stated, and the --since
revision the script actually resolved is reported rather than the version string
that was asked for. Every CVE without a Jira issue is listed with the overlays
commit URL that stands in for it. CVSS appears only where a ProdSec CVSS field
supplied it — a blank CVSS column is the correct output, never a filled-in guess.
Rows dropped by the --jql filter are counted, so the user can tell an empty
result from a filtered one. No credential or OAuth secret appears in any output.
