security-triage

Triage GitHub security advisories by applying exact tag and commit verification, trust-model checks, and inspecting shipped releases to close duplicates, irrelevant issues, or fixed vulnerabilities, keeping open those needing broader verification.

A security advisory trust-model check verifies the integrity of tags and commits in a GitHub repository, ensuring that shipped releases match the implicated code paths before making a high-confidence close or keep decision.

Prepare a maintainer-ready reply by logging the verification workflow results, including tag and commit checks, and appending optional hardening notes to create a final response suitable for posting or copy/pasting.

Yes, you can verify fixed vulnerabilities by inspecting tags, releases, and implicated code paths directly within your repository workflow, applying structured closure criteria to confirm the fix without requiring external dependencies.

Keep a GitHub security advisory open when broader verification is required beyond standard checks, whereas you can close it confidently when the issue is a duplicate, irrelevant, or already fixed in shipped releases.