andrewmusselman commented on code in PR #1519: URL: https://github.com/apache/mahout/pull/1519#discussion_r4260059889
########## .apache-magpie-overrides/project.md: ########## @@ -0,0 +1,578 @@ +<!-- SPDX-License-Identifier: Apache-2.0 + https://www.apache.org/licenses/LICENSE-2.0 --> + +<!-- START doctoc generated TOC please keep comment here to allow auto update --> +<!-- DON'T EDIT THIS SECTION, INSTEAD RE-RUN doctoc TO UPDATE --> +**Table of Contents** *generated with [DocToc](https://github.com/thlorenz/doctoc)* + +- [Apache Mahout — project manifest](#apache-mahout--project-manifest) + - [Identity](#identity) + - [Repositories](#repositories) + - [Mailing lists](#mailing-lists) + - [Tools enabled](#tools-enabled) + - [CVE tooling](#cve-tooling) + - [GitHub project board](#github-project-board) + - [Project chat](#project-chat) + - [Mail sources](#mail-sources) + - [Backend declaration](#backend-declaration) + - [Per-backend config](#per-backend-config) + - [Issue-template fields](#issue-template-fields) + - [Security workflow configuration](#security-workflow-configuration) + - [CVE authority](#cve-authority) + - [Governance](#governance) + - [Security inbox](#security-inbox) + - [Forwarders](#forwarders) + - [Mail provider](#mail-provider) + - [Archive system](#archive-system) + - [Project metadata](#project-metadata) + - [Security cross-reference](#security-cross-reference) + - [Tracker](#tracker) + - [Scope detection](#scope-detection) + - [Release process](#release-process) + - [Roster](#roster) + - [Product](#product) + - [Pointers to sibling files](#pointers-to-sibling-files) + +<!-- END doctoc generated TOC please keep comment here to allow auto update --> + +<!-- SPDX-License-Identifier: Apache-2.0 + https://www.apache.org/licenses/LICENSE-2.0 --> + +# Apache Mahout — project manifest + +This is the **project configuration** for `mahout`. +Every skill under [`../../.claude/skills/`](../../../skills/) +reads the project name from `<project-config>/project.md` and then loads this manifest to resolve project-specific identity, +repositories, mailing lists, and references to the other files in +this directory. + +**Note on Auto-sourcing:** Stable fields under Identity and Repositories +(`upstream_repo`, `upstream_default_branch`, `product_family_url`, labels) +can be automatically derived from GitHub repository metadata via +`gh repo view` during `/magpie-setup adopt` or `/magpie-setup upgrade`, for +any adopter. The **Mailing lists** are auto-sourced **only for +`organization: ASF`** projects (from `.asf.yaml`, with `*.apache.org` +defaults); a non-ASF `organization` fills them in by hand. Hand-editing is +only required when a source is absent, incomplete, or you wish to override +a derived value. + +Grep for `TODO` to see every field you still need to fill in: + +```bash +grep -n TODO projects/<name>/project.md +``` + +## Identity + +| Key | Value | +|---|---| +| `organization` | `ASF` | +| `project_name` | Apache Mahout | +| `vendor` | Apache Software Foundation | +| `short_name` | Mahout | +| `product_family_url` | https://mahout.apache.org/ | + +The `vendor` / `project_name` pair is what lands in the `vendor` and +`product` fields of the CVE 5.x record the CVE-JSON generator +produces. + +## Repositories + +| Key | Value | Purpose | +|---|---|---| +| `tracker_repo` | TODO: e.g. `foo-s/foo-s` | Private security tracker (this repo) | +| `tracker_repo_url` | TODO | | +| `tracker_default_branch` | TODO: e.g. `main` | Default PR target for the tracker repo | +| `tracker_project_board_url` | TODO: URL of the GitHub Project V2 board, if any | Security board | +| `upstream_repo` | `apache/mahout` | Public codebase where fixes land | +| `upstream_repo_url` | https://github.com/apache/mahout | | +| `upstream_default_branch` | `main` | Upstream's default branch — what `<default-branch>` resolves to. Distinct from `tracker_default_branch` | +| `upstream_agents_md_url` | TODO: `https://github.com/<upstream>/blob/main/AGENTS.md` | Conventions this repo mirrors | +| `upstream_contributing_docs_url` | https://github.com/apache/mahout/blob/main/CONTRIBUTING.md | | +| `upstream_genai_disclosure_anchor` | TODO: URL + anchor for the project's Gen-AI disclosure guideline | | +| `upstream_security_policy_url` | TODO: `https://github.com/<upstream>/security/policy` | | +| `security_pages_url` | TODO: e.g. `https://foo.apache.org/security` | Public security pages on the project website — updated by the release manager after each advisory (ASF security-committers policy step); read by `security-issue-sync` for the security-pages checklist reminder. Leave unset if the project has no security pages — the skill then uses the plain phrase without a link | + +## Mailing lists + +*(For `organization: ASF` projects only: auto-sourced from the `.asf.yaml` +`notifications:` block if present, else `*.apache.org` defaults. A non-ASF +`organization` has no `.asf.yaml` — fill these in by hand.)* + +| Key | Value | Notes | +|---|---|---| +| `security_list` | `[email protected]` | Inbound reports; **not** publicly archived (auto-sourced default) | Review Comment: @shahar1 we don't currently have a security@ list -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
