| name | cve-fix |
| description | Fix CVEs in Submariner Go repositories. Arguments are optional and order-independent. TRIGGER when user asks to fix CVEs, scan for vulnerabilities, or mentions grype/CVE/GHSA. |
| argument-hint | [branch] [repo] |
| user-invocable | true |
| allowed-tools | Bash, Read |
| context | fork |
CVE Fix Workflow
Run the command below exactly as written. Do not read, debug, or modify
the CVE scripts. If a bare repo name like subctl is passed, convert it
to ../subctl before running.
#!/bin/bash
set -euo pipefail
CVE_SCRIPTS="$(pwd)/scripts/cve"
if [[ ! -d "$CVE_SCRIPTS" ]]; then
CVE_SCRIPTS="$HOME/go/src/submariner-io/shipyard/scripts/cve"
fi
if [[ ! -d "$CVE_SCRIPTS" ]]; then
echo "ERROR: Cannot find scripts/cve/ directory"
echo "Expected in current directory or ~/go/src/submariner-io/shipyard/"
exit 1
fi
exec bash "$CVE_SCRIPTS/fix-all.sh" $ARGUMENTS
fix-all.sh does everything: detect config, create fix branch, scan for CVEs,
fix each deterministically, run tests, agent-review all results, and print
the PR command.
Exit code 0: All CVEs addressed. Review commits and run the printed PR command.
Exit code 2: Some CVEs unresolved after review.
Exit code 1: Error.
Multi-Repo
For multiple repos, spawn one agent per repo. Each agent should run
bash ~/go/src/submariner-io/shipyard/scripts/cve/fix-all.sh REPO BRANCH
via the Bash tool (not the Skill tool, which times out in subagents).
Report per repo: CVEs found, fixed, ignored, and PR command. On errors
or timeout, clean up orphaned processes with
bash ~/go/src/submariner-io/shipyard/scripts/cve/clean.sh before reporting.
Never modify the CVE fix scripts themselves.
Usage
/cve-fix - current repo, current branch/cve-fix 0.23 - current repo, specified branch (short form)/cve-fix ../submariner-operator - specified repo, current branch/cve-fix release-0.23 ../submariner-operator - both specified (order doesn't matter)
Arguments are order-independent. Short versions like 0.23 auto-expand
to release-0.23. Repos must be paths. If a bare name like subctl is passed, resolve it
to ../subctl (from any submariner repo) or ~/go/src/submariner-io/subctl.
From the command line (without Claude):
make cve-fix
make cve-fix BRANCH=release-0.23
make cve-fix REPO=../submariner-operator BRANCH=release-0.23
Common Issues
| Issue | Solution |
|---|
| CVE persists after fix | Verify FIXED-IN version; check for replace directives |
| New CVE appears after fix | Dependency downgrade introduced it; fix immediately |
| Tests fail | Try different version; check CI logs |
| Container "no route to host" | Run sudo systemctl restart docker or sudo systemctl restart podman |
| Stdlib CVEs | Fixed via go directive update. Check Shipyard Go version if CI fails |
| Git fetch fails | Run git fetch manually before starting |
