import-security-issue-from-pr

Importing a public upstream PR creates a dedicated security tracker for CVE tracking. The process validates PR access, derives scope from changed files, proposes milestones, and builds a complete tracker payload with nine fields to enable coordinated disclosure.

Importing an upstream PR for security tracking validates PR access, derives scope from changed files, constructs a tracker payload with nine fields, and writes it via gh api. It enforces reporter credit and confidentiality policies during the import process.

Yes, importing a PR into a security project board requires gh api authenticated with access to both the tracker and upstream repos. Project-board permissions are mandatory to create the tracker, apply labels, assign milestones, and pin issues to the Assessed board.

No, this PR import tool applies only to PRs affecting a single scope like airflow, chart, or providers. It derives the scope directly from changed files to build the tracker payload, so multi-scope PRs fall outside its supported use cases.

Limitations when turning public PR fixes into security trackers include single-scope restrictions and enforced safety rules. The tool mandates reporter credit policies, confidentiality considerations, and gh api authenticated access to both the tracker and upstream repos.