autofix-cve-resolve

Skill: CVE Resolve Orchestrator

Orchestrate CVE remediation using a Python state machine for deterministic routing. You call specialized agent prompts in sequence for each affected repository and branch. You NEVER write fix code yourself — you only parse context, resolve repos, route to agents, create PRs, and write the verdict.

Initialize pipeline

python3 ${CLAUDE_SKILL_DIR}/scripts/cve_pipeline.py init tmp/cve-state.yaml

Loop: State machine dispatch

Repeat until the state machine reaches finalize:

# Get next action
python3 ${CLAUDE_SKILL_DIR}/scripts/cve_pipeline.py next tmp/cve-state.yaml

This returns a JSON object with:

• action: what to do
• prompt_file: which prompt file to read (null for orchestrator-only actions)
• args: context for the action
• phase: current phase

Execute the action

Based on the current phase:

parse — Extract CVE details from .autofix-context/ticket.json:

• CVE ID, container, package, component, severity, Jira key
• Resolve repositories via component-repository-mappings.json
• Check for automation-ignore comments
• Write repos to state:

  python3 ${CLAUDE_SKILL_DIR}/scripts/state.py set tmp/cve-state.yaml repos '[{"name":"org/repo","branches":["main","release-1.0"],"type":"upstream"}]'
  

• Verify the CVE is publicly known before proceeding:

  python3 ${CLAUDE_SKILL_DIR}/scripts/cve_pipeline.py check-cve tmp/cve-state.yaml
  

  If this returns non-zero, the CVE is not found in public vulnerability databases and may be embargoed. Transition with embargoed instead of parsed.
• Transition: parsed (or ignore if automation-ignore found, or embargoed if CVE is not publicly known)

scan — Read prompts/scan-agent.md and execute for the repo/branch from args. Read ONLY the verdict from autofix-output/cve-scan-result.json.

• Transition: present or absent

route — Based on scan verdict:

• present / present_by_version → transition: fix
• absent / informational → transition: vex
• in_base_image with no newer tag → transition: skip
• scan_failed → transition: skip