report-to-jira

Report to Jira

Posts the completed CVE analysis report as a comment on the source Jira ticket — the same ticket the CVE details were read from (SOURCE_TICKET, set in Phase 0.5 from --jira=/--jql=). Always called as the last step of Phase 4, after the report has been generated. Also reused by create-fix-pr (Phase 6) for a short follow-up comment containing the PR URL.

If no Jira ticket was involved (direct <CVE-ID> mode), this skill is skipped entirely — there is nothing to post to.

---

Step 1: Confirm Report is Ready

Before posting, verify the following are available from the parent command:

• Final report content (full markdown from Phase 3)
• CVE ID (e.g. CVE-2024-45338)
• SOURCE_TICKET — the Jira ticket key from --jira=/--jql= (e.g. OCPBUGS-12345). This is the only ticket this skill writes to.
• jira_context — label snapshot from Phase 0.5 (jira_context["labels"]); used as a hint only — Step 4.5 re-fetches current labels before writing
• Risk level (HIGH / MEDIUM / LOW / NEEDS_REVIEW)
• AUTO_APPROVE (yes/no, default no) — governs the Step 3b visibility-downgrade fallback prompt

If SOURCE_TICKET is not available (direct CVE mode): return status: skipped with reason "no_source_ticket".

If the report is incomplete or Phase 3 did not finish, return status: skipped with reason.

---

Step 2: Build the Comment Body

Read ${AI_HELPERS_WORKSPACE:-.}/.work/compliance/analyze-cve/${CVE_ID}/report.md from Phase 3 and post it in full. The Jira comment is the report — do not pre-emptively shorten it or write a separate jira-comment.md.

Write standard Markdown — Jira Cloud renders Markdown natively when posted with contentFormat: "markdown" (see markdown-for-jira reference if that plugin is installed; the syntax is standard CommonMark either way). No wiki-markup conversion is needed.

Default body = attribution header + entire report.md. If Phase 4 produced a remediation plan not already under ## Remediation in the report, append it as ## Remediation Plan (Phase 4).