openclaw-ghsa-maintainer

Safely publishing GHSA security advisories requires verifying the private fork has no open PRs, validating the vulnerability payload shape, and applying PATCH calls in the correct sequence to prevent unsafe actions during the publish workflow.

The correct payload format for GitHub Security Advisories involves constructing structured JSON payloads for API transmission and Markdown payloads for advisory descriptions, ensuring the vulnerability data strictly conforms to GHSA API constraints before publishing.

Checking if a private fork has open pull requests before publishing an advisory involves inspecting the repository state through the GitHub API, ensuring no open PRs exist before applying sequential PATCH calls to publish the GHSA advisory safely.

Yes, you can use gh, jq, and curl to automate GHSA advisory maintenance by writing guarded shell scripts that fetch advisory state, validate payload shapes, and sequence API calls while respecting GitHub API constraints to prevent unsafe actions.

Guardrails needed when patching GitHub security advisories include robust sequencing of API calls, state validation based on SKILL.md frontmatter, and checks to verify the private fork has no open PRs, which stop unsafe actions before the publish step.

Your GHSA advisory publish may be failing during validation if the vulnerability payload shape is incorrect, if the Markdown or JSON payloads do not meet API constraints, or if the private fork has open PRs blocking the sequential PATCH calls.