openclaw-ghsa-maintainer

To patch GitHub security advisories, use API PATCH workflows that enforce separation of updates, requiring separate fields for patching severity and CVSS. This guardrail ensures advisory details are updated safely without conflicting field modifications during the patch sequence.

Publishing a GHSA advisory safely requires validating that all private fork PRs are closed before publishing. The workflow inspects the private-fork state, confirms no open PRs remain, and enforces guardrails to ensure the advisory is ready for public release.

Inspecting a GHSA advisory involves fetching the current advisory state to verify its status. This initial step in the workflow confirms the advisory's existing conditions and ensures all subsequent patching and publishing actions operate on accurate data.

Automating the security advisory workflow is supported end-to-end, covering inspection, patching, validation, publishing, and confirmation of private-fork state. The workflow applies guardrails and advisory state checks throughout the sequence to maintain safe patch application.

Publishing a GHSA advisory while private fork PRs are open is blocked by validation checks. The workflow enforces a guardrail requiring all private fork PRs to be closed before publishing, preventing incomplete or conflicting patch sequences from going live.

A structured patch sequence for repository security advisories is needed when updates require guardrails, advisory state checks, and safe patch application across GHSA records and forks. This ensures changes like severity and CVSS updates are applied in the correct order without conflicts.