openclaw-ghsa-maintainer

To publish a GitHub Security Advisory safely, you must verify the advisory state, ensure the private fork has no open PRs, construct PATCH payloads with jq, and apply ordered updates to avoid violating GHSA API sequencing constraints.

Publishing a GHSA fails when setting severity and cvss_vector_string together because GitHub enforces field-setting constraints. You must apply PATCH calls in the required order to avoid conflicting field updates during advisory publication.

Validating a private fork before publishing a GitHub security advisory requires checking that the linked fork has no open pull requests, which satisfies the mandatory GHSA publish constraints for repository security advisories.

To fix escaped newline artifacts in published GHSA descriptions, generate advisory Markdown safely via a temp file and verify description newline integrity post-publish by re-fetching the advisory to confirm correct formatting.

Yes, you need to check SECURITY.md before updating a GitHub security advisory to confirm advisory guardrails and ensure all GHSA-only actions honor the repository's specified security policy constraints.

Correct PATCH sequencing for GitHub security advisory fields involves fetching advisory state, validating npm version metadata, using jq for payload correctness, and applying ordered PATCH updates while respecting field constraints like severity and cvss_vector_string.