main

name: vmt-digest description: Generate a weekly VMT (Vulnerability Management Team) digest email from tektoncd security advisory data. USE WHEN user says ‘vmt digest’, ‘weekly vmt’, ‘security digest’, ‘vmt email’, or wants to generate the weekly VMT triage summary.

VMT Weekly Digest

Generate a weekly digest email for the tekton-vmt mailing list summarizing the current state of security advisories across the tektoncd GitHub org.

Workflow

  1. Fetch data: Run the fetch-advisories script from tektoncd/plumbing
  2. Generate digest: Format the data into a clear, actionable email

Step 1: Fetch Advisory Data

Run the fetch script. The script location depends on the user’s setup:

# From tektoncd/plumbing repo
python3 vmt/fetch-advisories.py > /tmp/vmt-advisories.json

# Or from anywhere if plumbing is checked out
python3 ~/src/tektoncd/plumbing/vmt/fetch-advisories.py > /tmp/vmt-advisories.json

Read the output JSON from /tmp/vmt-advisories.json.

Step 2: Generate Digest Email

Using the JSON data, generate an email with this structure:

Email Format

Subject: [tekton-vmt] Weekly Digest — YYYY-MM-DD

Body sections:

1. Summary

One-line counts: X in triage, Y drafts in progress, Z published, W closed.

2. 🔴 Needs Triage (state: triage)

Reports that have been submitted but not yet assessed. For each:

  • Repo/GHSA-ID — summary (severity if set)
  • Days since submitted
  • Reporter
  • ⚠️ Flag if > 7 days without triage

3. 🟡 In Progress (state: draft)

Advisories being worked on. For each:

  • Repo/GHSA-ID — summary (severity)
  • Days open, days since last update
  • Credits (who’s working on it)
  • ⚠️ Flag if > 14 days since last update

4. 📢 Recently Published (last 7 days, state: published)

Advisories published in the past week. Brief summary for awareness.

5. 📊 Staleness Alerts

Any advisory (any state) not updated in > 30 days. Highlight for attention.

Tone

  • Professional but concise
  • Action-oriented: make clear what needs doing
  • Don’t include full descriptions — just enough context to know what it is
  • Link to the GHSA URL so people can click through

Example Item

🔴 pipeline / GHSA-g8w8-pwp7-25vp — bundle resolver unbounded memory allocation (medium)
   Submitted 10 days ago by reporter-login
   ⚠️ Needs triage — no assessment yet
   https://github.com/tektoncd/pipeline/security/advisories/GHSA-g8w8-pwp7-25vp

Notes

  • The digest is meant to be sent manually (copy-paste to mailing list)
  • No explicit assignments for now — that’s a future discussion with the VMT team
  • Credits/collaborators are shown for awareness, not as assignments
  • Output as plain text (mailing list friendly), not HTML