File tree Expand file tree Collapse file tree 1 file changed +21
-1
lines changed Expand file tree Collapse file tree 1 file changed +21
-1
lines changed Original file line number Diff line number Diff line change @@ -38,7 +38,27 @@ If the advisory came from GHSA, we have two options:
38
38
- Either use only data published in the associated CVE, since the CVE database is in the public domain
39
39
- Or ask the submitter of the GHSA advisory (not the RustSec pull request author) to release the advisory contents into the public domain
40
40
41
-
42
41
## Thank the submitter and any other participants
43
42
44
43
Let them know they did a nice and useful thing. That's how you get repeat submitters ;)
44
+
45
+ ## (Optional) Check Triage Labels
46
+
47
+ It is helpful to Categorise by what the PR Author intent is - see: Propose-Close/Merge for proposed.
48
+
49
+ - ` Unsound ` - The PR author suggests the advisory is informational/unsound
50
+ - ` Unmaintained ` - The PR author suggests the advisory is informational/unmaintained
51
+
52
+ It is sometimes important to ensure we know what is going on with each PR so we can efficiently check and follow-up.
53
+
54
+ - ` Waiting-Maintainer ` - We are waiting for the Maintainer to provide any response if any.
55
+ - ` Waiting-Author ` - We are waiting for the Author of PR
56
+
57
+ It could be also useful to [ radiate the intent] when dealing with PRs - Especially controversial ones to allow feedback.
58
+
59
+ - ` Propose-Close ` - PR may be Closed soon if nobody objects.
60
+ - ` Propose-Merge ` - PR may be Merged soon if nobody objects.
61
+
62
+ Time period of Objection to either Merge or Close depends on the controversial aspect and / or urgency of the PR.
63
+
64
+ [ radiate the intent ] : https://github.com/rustsec/advisory-db/discussions/1325
You can’t perform that action at this time.
0 commit comments