Rhdh Overlay Cve Export

---
name: rhdh-overlay-cve-export
description: >-
  Builds the "RHDH CVE Management - <version>-plugins.csv" export by walking
  `rhdh-plugin-export-overlays` git history on a release branch since a revision,
  scoped to generally-available plugin workspaces, then enriching each CVE from
  Jira RHIDP, RHDHBUGS, and RHDHPLAN. Use for "generate the plugin overlay CVE CSV
  for 1.10.3", "what CVEs were fixed in plugins since 1.10.2", or "rebuild the
  plugin CVE list with the ProdSec CVSS scores".
compatibility: "Node 18+, git, and gh; a checkout or clone of rhdh-plugin-export-overlays; /rhdh-jira-api for CVE enrichment."
---

# Plugin overlay CVE export

Turn overlays git history into the CSV that RHDH CVE Management expects: one row
per CVE and affected plugin package, scoped to generally-available workspaces.

This is a package-inventory job, not release reporting. It answers "which plugin
containers carry which CVE fix", from git — not "how is the release doing", which
is `/rhdh-release-status`.

## Route

Load `workflows/overlay-cve-export.md`. It covers the extract run, Jira
enrichment, and the flag set.

Two references belong to this workflow alone and are read on demand:

- `references/overlay-cve-csv-format.md` — the exact header, the row rule, the
  Container column, and the default output path.
- `references/overlay-cve-sources.md` — which workspaces and commits count, how
  CVEs and Jira keys are extracted, and how `--since` resolves.

## Do not reimplement the parsing

`scripts/compute-plugin-package-overlay-cve-list.mjs` owns commit selection, CVE
extraction, pairing, dedupe, and CSV shape. Run it. Reading the overlays repo by
hand and assembling rows in chat produces a different answer than the export the
CVE process is checked against.

The script never calls Jira. Enrichment is a separate pass: invoke `/rhdh-jira-api`
for the issue fields, write them to a JSON file, and feed that back through
`--apply-enrich`.

## Writing rules

The extract itself only clones and reads. Writing the enrichment JSON and the
final CSV creates files on the user's disk — say where they will land and get
agreement before the run that writes them. Never commit the CSV into a
repository, and never post it anywhere.

## Completion

Complete when the CSV path is named, the row count is stated, and the `--since`
revision the script actually resolved is reported rather than the version string
that was asked for. Every CVE without a Jira issue is listed with the overlays
commit URL that stands in for it. CVSS appears only where a ProdSec CVSS field
supplied it — a blank CVSS column is the correct output, never a filled-in guess.
Rows dropped by the `--jql` filter are counted, so the user can tell an empty
result from a filtered one. No credential or OAuth secret appears in any output.