microshift-dev-golang-cve-analyzer

name	microshift-dev:golang-cve-analyzer
argument-hint	<jira-id> [--verbose]
description	Check if a MicroShift CVE Jira ticket is fixed in the latest Brew nightly golang build
user-invocable	true
allowed-tools	Bash, mcp__mcp-atlassian__jira_get_issue

microshift-dev:golang-cve-analyzer

Synopsis

/microshift-dev:golang-cve-analyzer <jira-id> [--verbose]

Description

Validates that a Jira ticket is a CVE bug with MicroShift component, extracts the target OCP minor version, and checks whether the CVE is already fixed in the Go toolchain used by the latest MicroShift nightly Brew build.

Prerequisites

Requirement	Needed for	Mandatory?
VPN	Brew API access	Yes
Jira MCP (mcp-atlassian)	Fetching ticket details	Yes
JIRA_USERNAME / JIRA_API_TOKEN	Jira MCP authentication	Yes

Arguments

• $ARGUMENTS (required): A Jira issue key (e.g., OCPBUGS-12345) and optional --verbose flag.

Scripts Directory

All scripts are run relative to the plugin directory:

SCRIPTS_DIR=${PLUGIN_DIR}/scripts

Implementation

Step 1: Parse Arguments

1. Extract the Jira issue key — the first token matching [A-Z]+-\d+ pattern
2. Detect --verbose flag

Step 2: Fetch the Jira Ticket

If the mcp__mcp-atlassian__jira_get_issue tool is not available, stop and show:

The mcp-atlassian MCP is required but not enabled in this session.

To enable it, install the mcp-atlassian plugin:

  /plugin marketplace add openshift-eng/edge-tooling

Select `mcp-atlassian` when prompted. Ensure JIRA_USERNAME and JIRA_API_TOKEN are set.
Then restart Claude Code and re-run the command.

Otherwise, fetch the ticket:

mcp__mcp-atlassian__jira_get_issue(
  issue_key="<jira-id>",
  fields="summary,status,components,versions,fixVersions,labels,description,issuetype"
)

Step 3: Validate the Ticket

Perform these checks on the returned ticket. If any check fails, report the failure and stop.

1. MicroShift component check: At least one entry in components must contain "MicroShift" (case-insensitive). If not:

   FAILED: Not a MicroShift ticket. Components: <list of components or "none">
   

2. CVE check: The ticket summary or description must contain at least one CVE ID (pattern CVE-YYYY-NNNNN). Extract all CVE IDs found. If none:

   FAILED: No CVE ID found in summary or description
   

If both checks pass, display:

Ticket  : <KEY> - <summary>
Status  : <status>
CVEs    : <comma-separated CVE IDs>

Step 4: Extract Minor Version

Determine the X.Y minor version from the ticket, checking in this order:

1. fixVersions — look for a version matching 4.\d+ pattern
2. versions (affected versions) — same pattern
3. summary — extract 4.\d+ from the title

If no version can be determined:

FAILED: Could not determine X.Y version from ticket fields

Step 5: Run the Golang CVE Check

Run the brew_golang_cves.py script with the extracted version:

python3 ${SCRIPTS_DIR}/brew_golang_cves.py <X.Y> --json

If the script exits non-zero, display stderr and suggest:

• VPN not connected → connect to VPN

Parse the JSON output to get:

• microshift_build.nvr — the MicroShift nightly build NVR
• golang.nvr — the golang version used
• cves — list of all CVEs fixed in that golang version

Step 6: Match CVEs and Report

Compare the CVE IDs from the Jira ticket (Step 3) against the CVEs from the golang changelog (Step 5).

For each CVE from the ticket, check if it appears in the golang CVE list.

Display the result in this format:

Ticket  : <KEY> - <summary>
Status  : <status>
CVEs    : <CVE-IDs from ticket>
Version : <X.Y>

MicroShift build : <microshift NVR>
Golang version   : <golang NVR>

OK       CVE-YYYY-NNNNN  (fixed <date>, release <golang-release>)
MISSING  CVE-YYYY-NNNNN

• OK means the CVE is present in the golang changelog (already fixed)
• MISSING means the CVE is NOT in the golang changelog (not yet fixed in this golang version)

If --verbose was passed, also list all CVEs fixed in the golang version:

All CVEs in golang <golang-nvr>:
  <date>  <CVE-ID>
  <date>  <CVE-ID>
  ...

Step 7: Summary

End with a one-line summary:

• If all CVEs are fixed: All CVEs from <KEY> are fixed in golang <golang-nvr>.
• If some are missing: <N> of <total> CVEs from <KEY> are NOT fixed in golang <golang-nvr>.

Do NOT add any additional commentary or explanation beyond this.

Examples

/microshift-dev:golang-cve-analyzer OCPBUGS-12345
/microshift-dev:golang-cve-analyzer OCPBUGS-12345 --verbose

Notes

• Read-only — does NOT modify any tickets or external state
• VPN required for Brew access
• The golang CVE list comes from the RPM changelog of the golang package used to build MicroShift