mirror of
https://github.com/pewdiepie-archdaemon/odysseus.git
synced 2026-10-20 13:52:24 +02:00
Alexandre Teixeira
a0137b47d1
Adapt the agreed maintainer responsibilities and risk-based review policy for the public repository. Add evidence-driven security review, CodeQL triage, release guidance and a discoverable contributing link.
49 lines
2.3 KiB
Markdown
49 lines
2.3 KiB
Markdown
# Triage
|
|
|
|
Triage turns reports into evidence-backed work that a maintainer can pick up without guessing.
|
|
|
|
## Intake flow
|
|
|
|
```text
|
|
Report
|
|
-> reproduce / clarify
|
|
-> identify duplicates and affected versions
|
|
-> classify impact, urgency, and risk
|
|
-> prepare actionable work item
|
|
-> maintainer takes ownership
|
|
-> PR, verification, and follow-up
|
|
```
|
|
|
|
## A useful work item
|
|
|
|
Record what is known and distinguish it from what remains unverified:
|
|
|
|
- Original report and reproducible steps; installation method, OS, version/commit, and relevant environment.
|
|
- Expected versus actual behavior, including user-visible impact.
|
|
- Evidence: sanitized logs, screenshots, failing tests, or controlled reproduction.
|
|
- Related issues, PRs, duplicates, or a known prior regression.
|
|
- Scope, acceptance criteria, and non-goals.
|
|
- Priority, ownership, and relevant domain expertise.
|
|
- Remaining unknowns, risks, and safe recovery or workaround when available.
|
|
|
|
Small and obvious fixes may go straight to a focused PR, consistent with [CONTRIBUTING.md](../../CONTRIBUTING.md) and [changes and review](changes-and-review.md).
|
|
|
|
## Practical priority language
|
|
|
|
Use P0-P3 as **triage shorthand**, not as a substitute for verified exploitability or the project's actual GitHub labels:
|
|
|
|
| Priority | Typical impact | Expected response |
|
|
|---|---|---|
|
|
| P0 | Active exploitation, broad irreversible loss, catastrophic outage | Immediate containment and escalation |
|
|
| P1 | Credible severe security or data-integrity vulnerability | Urgent owner assignment and validated fix |
|
|
| P2 | Significant correctness, security, or operational regression | Prioritize and resolve before approving affected high-risk changes |
|
|
| P3 | Limited impact, maintainability, or low-risk polish | Fix or explicitly track with rationale |
|
|
|
|
Do not call a concern harmless merely because an automated check is green. Escalate privately when reproduction would disclose a vulnerability.
|
|
|
|
## Where decisions live
|
|
|
|
Matrix is for coordination; durable decisions belong in GitHub, Plane, a specification, or the relevant PR. Keep confidential security and access details in appropriate private channels. Do not leave important project decisions only in chat history.
|
|
|
|
See the [review playbook](review-playbook.md) for converting triage into review evidence and handling contested or uncertain findings.
|