yds-report-to-issues

Workflow

Phase 1: Locate Report

1. If the user specifies a file path, use it directly.
2. Otherwise, list available reports:
   • docs/evaluation/ — yds-software-evaluation reports
   • docs/security-audit/ — yds-vulnerability-scan reports
   • If multiple exist, ask the user to select one.
3. Detect report type by content:
   • Contains ## Improvement Roadmap → evaluation report
   • Contains ## Remediation Priority → security-audit report

---

Phase 2: Extract Tasks

Evaluation report — extract rows from ## Improvement Roadmap tables (P0–P3):

Each row yields:

• priority: P0 / P1 / P2 / P3
• title: Problem column (first sentence or file:line prefix)
• problem: full Problem cell
• solution: Solution cell
• expected_outcome: Expected Outcome cell

Security-audit report — extract from ## Remediation Priority table AND individual ## Findings sections:

Each row yields:

• priority: P0 / P1 from Priority column
• title: Finding column
• action: Action column
• body: full finding detail from the matching ### V-XX section (Vulnerable Code, Attack Path, Risk Assessment, Recommended Fix)

---

Phase 3: Present Tasks for Selection

Display all extracted tasks before creating any issue:

Extracted tasks from <report file>:

  1. [P0] <title> (<file:line if present>)
  2. [P1] <title>
  3. [P1] <title>
  ...

Which tasks would you like to register as GitHub Issues?
Enter numbers (e.g. 1 3 5), a range (e.g. 1-3), "all", or "none":

Wait for the user's response before proceeding.

---

Phase 4: Duplicate Detection

Before creating issues, check for existing issues that may overlap with the selected tasks.

4.1 Fetch existing open issues:

gh issue list --state open --json number,title,labels --limit 200

4.2 For each selected task, check for duplicates:

Compare the task title/problem against existing issue titles using keyword overlap. Flag a potential duplicate when:

• 3+ significant keywords match between the task and an existing issue title/body
• The same file:line location is referenced
• The same label combination exists (e.g., both P0 + security-audit)