openclaw-ghsa-maintainer

Automating GitHub Security Advisory maintenance involves retrieving the advisory state, verifying linked private fork pull requests are closed, applying Markdown and JSON payload patches in sequence, and enforcing guardrails for safe publishing.

Safe GHSA patching requires verifying no open pull requests exist in the private fork, executing PATCH API calls in the correct order using prepared payloads, and enforcing permission checks to prevent accidental exposure before publishing.

The correct patch sequence for a GitHub Security Advisory is to fetch and inspect the advisory state, validate the linked private fork readiness, build the Markdown and JSON payloads, execute the PATCH calls, and verify the publish success.

Checking private fork pull requests before publishing a GHSA advisory is required to ensure no open PRs exist, which prevents unintended changes and maintains safety constraints during the automated advisory maintenance workflow.

Guardrails for GHSA advisory publishing enforce strict permission checks and safety constraints to prevent accidental exposure, requiring private fork PR verification and correct patch sequencing before allowing any publish action to proceed.