Hackathon/CVE ai agent triage - #797
Draft
hshankar31 wants to merge 4 commits into
Draft
Conversation
Spike AUTOMATE-CVE-000 is complete. This commit brings all spike
deliverables and hackathon preparation materials onto a clean branch
from datastax/pulsar master so the 3-pair team can work without
touching production code.
Contents:
- automate-cve-000-spike-plan.md spike plan (all 6 sub-tasks done)
- hackathon-plan.md pair assignments + pre-work checklist
docs/spike/
ADR-001-cve-pipeline-architecture.md
unified-cve-triage-schema.json
sample-cve-input.json (10 real CVEs from 3.1_ds scan)
bob-tty-findings.md
credential-injection-findings.md
json-schema-findings.md
coin-budget-findings.md
e2e-dry-run-findings.md
docs/hackathon/
README.md team assignments + day-1 checklist
shared-image-ref.md template (fill before hackathon day)
study-bob.md IBM Bob cheat sheet
study-code-engine.md IBM Code Engine cheat sheet
study-secrets-manager.md IBM Secrets Manager cheat sheet
study-trivy.md Trivy + Snyk cheat sheet
prompts/
triage.txt canonical CVE triage prompt
triage-v{1-5}.txt 5 A/B variants
fix-java-dep.txt Java pom.xml dep-bump agent prompt
fix-dockerfile.txt Dockerfile FROM/apk fix agent prompt
scripts/
normalise-bob-output.py Bob output parser + schema validator
estimate-bob-coins.sh coin budget estimation helper
scan_vulnerabilities.sh manual Trivy scan helper
check_alpine_packages.sh Alpine package version checker
docker/cve-spike/
Dockerfile.bob-test validated headless Bob base image
test-bob-tty.sh TTY-free invocation test suite
test-credential-injection.sh credential injection test suite
e2e-dry-run.sh 7-step end-to-end pipeline dry run
infra/cve-automation/
README.md
job-definitions/cve-scanner-job.yaml Code Engine job template
secrets/required-secrets.md 4 secrets + provisioning CLI
…ve-ai-agent-triage - Replace all mentions of '3.1_ds' as the working branch with 'hackathon/cve-ai-agent-triage' - Add explicit Git workflow section in docs/hackathon/README.md: clone → checkout hackathon branch → create pair branch from it (pair-a/cve-triage, pair-b/cve-fix-agents, pair-c/cve-observability) - PRs from pair branches target hackathon/cve-ai-agent-triage, not master - Day-1 checklist now starts with 'git checkout hackathon/cve-ai-agent-triage'
…teams
Removed:
- automate-cve-000-spike-plan.md (internal spike execution log)
- hackathon-plan.md (internal pre-hackathon setup todos)
- prompts/triage-v{1-5}.txt (A/B test variants from spike, not needed)
- docker/cve-spike/test-bob-tty.sh (spike validation only)
- docker/cve-spike/test-credential-injection.sh (spike validation only)
Kept: all docs/hackathon/, docs/spike/, prompts/triage.txt + fix-*.txt,
scripts/, infra/, docker/cve-spike/Dockerfile.bob-test + e2e-dry-run.sh
Removed from public team branch (no references in any team-facing file): - docs/spike/credential-injection-findings.md - docs/spike/e2e-dry-run-findings.md - docs/spike/json-schema-findings.md Remaining in docs/spike/ (actively used by team files): - ADR-001-cve-pipeline-architecture.md (README.md required reading) - sample-cve-input.json (study-bob.md, e2e-dry-run.sh, estimate-bob-coins.sh) - unified-cve-triage-schema.json (study-trivy.md, normalise-bob-output.py) - bob-tty-findings.md (required-secrets.md) - coin-budget-findings.md (estimate-bob-coins.sh)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This commit brings all spike deliverables and hackathon preparation materials onto a clean branch from datastax/pulsar master so the 3-pair team can work without touching production code.
Contents:
docs/spike/
ADR-001-cve-pipeline-architecture.md
unified-cve-triage-schema.json
sample-cve-input.json (10 real CVEs from 3.1_ds scan)
bob-tty-findings.md
credential-injection-findings.md
json-schema-findings.md
coin-budget-findings.md
e2e-dry-run-findings.md
docs/hackathon/
README.md team assignments + day-1 checklist
shared-image-ref.md template (fill before hackathon day)
study-bob.md IBM Bob cheat sheet
study-code-engine.md IBM Code Engine cheat sheet
study-secrets-manager.md IBM Secrets Manager cheat sheet
study-trivy.md Trivy + Snyk cheat sheet
prompts/
triage.txt canonical CVE triage prompt
triage-v{1-5}.txt 5 A/B variants
fix-java-dep.txt Java pom.xml dep-bump agent prompt
fix-dockerfile.txt Dockerfile FROM/apk fix agent prompt
scripts/
normalise-bob-output.py Bob output parser + schema validator
estimate-bob-coins.sh coin budget estimation helper
scan_vulnerabilities.sh manual Trivy scan helper
check_alpine_packages.sh Alpine package version checker
docker/cve-spike/
Dockerfile.bob-test validated headless Bob base image
test-bob-tty.sh TTY-free invocation test suite
test-credential-injection.sh credential injection test suite
e2e-dry-run.sh 7-step end-to-end pipeline dry run
infra/cve-automation/
README.md
job-definitions/cve-scanner-job.yaml Code Engine job template
secrets/required-secrets.md 4 secrets + provisioning CLI