invalidate-security-issue

To automatically close invalid security trackers, this skill updates GitHub tracker labels, posts a concise closing comment, and archives the project-board item. It also handles Gmail drafts for mailing-list imports while skipping email for PR-imported items.

Drafting Gmail replies for invalidated security reports involves surfacing verbatim reasoning quotes from the discussion to construct a canned-response email body on the original inbound thread, but only for trackers imported via the Security mailing list.

Applying invalid dispositions to security trackers is done by updating tracker labels to mark them invalid and removing scope-related labels. This action is triggered by running the invalidate command with the specific tracker number.

Invalidating a security tracker does not interact with public PRs when the tracker was originally imported from a PR. It skips email drafting in those cases and only drafts Gmail replies for mailing-list-imported trackers to preserve audit history.

Closing security triage items includes safeguards for CVE allocations and published advisories. The invalidation process relies on gh CLI, project-board mutations, and Gmail draft backends to ensure these specific edge cases are handled correctly.