Repository navigation
Exclude issues pending CVE assignment from team CVE counts #91
Description
Description
Issues with status/cve-request + severity/medium + status/not-embargoed currently count against teams in the CVE dashboard, turning their status red or yellow. Teams have no control over this — they are waiting for secalert to assign the CVE ID.
The dashboard should only count issues with status/cve-assigned against teams. Issues still in status/cve-request should be tracked separately (or excluded) so that the delay in CVE ID assignment does not penalize teams.
Motivation
Teams are being held accountable for delays outside their control. The CVE request-to-assignment handoff is owned by secalert, not the engineering teams. Counting these issues against teams produces misleading dashboard signals and erodes trust in the metrics.
Details
Currently GitHubLoader.sanitize() strips status/cve-request and status/cve-assigned labels, and CveTeamStat counts all open kind/cve issues indiscriminately.
Two changes are needed:
- Preserve
status/cve-requestandstatus/cve-assignedlabels inGitHubLoader.sanitize()(alongside the already-preservedstatus/triage,status/blocked-external, etc.) - Update
CveTeamStatandPrivateCveTeamStatto exclude issues withstatus/cve-request(but nostatus/cve-assigned) from the "Open" and "Open Overdue" team counts
Activity
Exclude issues pending CVE assignment from team CVE counts
Exclude issues pending CVE assignment from team CVE counts