From ac60ee2045775ce734c1ecc8545adb56d44aedc1 Mon Sep 17 00:00:00 2001 From: Jarek Potiuk Date: Fri, 1 May 2026 09:29:43 +0200 Subject: [PATCH] docs(sync-security-issue): codify "rollup is default; standalone comments only for RM" The skill already documented two release-manager-directed standalone comments (hand-off at Step 12, publication-ready at Step 14) as exceptions to the rollup model, but did not state the closed-list rule itself: that those two are the *only* allowed standalone comments and everything else goes into the rollup. Add a principle paragraph at the top of Step 2b's comment-policy section so the two RM-comment bullets that follow read as the exhaustive exception list, not just two examples among others. Reason: separate comments on the tracker read as direct asks to the release manager; mixing routine sync bookkeeping (label swaps, milestone moves, fix-PR links, etc.) into standalone comments dilutes the RM's signal. The rollup keeps housekeeping in one collapsible block; standalone comments stay reserved for "RM: do this". Co-Authored-By: Claude Opus 4.7 (1M context) --- .claude/skills/sync-security-issue/SKILL.md | 21 +++++++++++++++++++++ 1 file changed, 21 insertions(+) diff --git a/.claude/skills/sync-security-issue/SKILL.md b/.claude/skills/sync-security-issue/SKILL.md index b9a8666e..c8218706 100644 --- a/.claude/skills/sync-security-issue/SKILL.md +++ b/.claude/skills/sync-security-issue/SKILL.md @@ -1297,6 +1297,27 @@ will change and *why*. Group them by category: Re-read that file before composing the entry body — the zero-extra-spacing rule is load-bearing and easy to miss. + **Standalone comments are reserved for release-manager + instructions only.** The rollup is the default surface for + every sync output — status changes, label rationale, milestone + moves, assignee swaps, reporter-draft notes, fix-PR links, + CVE-review-comment surfacing, legacy-fold entries, recap + pointers, blockers, *everything*. The **only** comment shapes + this skill posts as separate, first-class comments outside the + rollup are the two **release-manager-directed call-to-action** + comments documented further down in this Step 2b list: the + *Release-manager hand-off comment* (fired at the + `pr merged` → `fix released` transition, Step 12) and the + *Publication-ready notification comment* (fired at the + *Public advisory URL* update, Step 14). Both exist because they + tell the RM to *do something next* on a fresh, dated, + mention-bearing surface — the rollup's `
`-collapsed + entries are the wrong shape for an actionable nudge. If a + proposal does not fit one of those two shapes, it goes into the + rollup. When in doubt, default to the rollup; do not invent a + new standalone-comment shape because something "feels important + enough". + **Entry shape for a sync pass.** Inside the rollup's `
` block, emit: