Add CONTRIBUTING.md#3
Merged
Merged
Conversation
Describe the two contribution paths: annotating a homebrew-core patch with resolves (auto-generated BREW-<formula>-<CVE> record) and opening a PR with a curated OSV record (BREW-0000-0000 placeholder, id assigned on merge). Includes a minimal record template, disclosure guidance and scope.
8 tasks
The workflow refreshes upstream-derived fields but keeps published and affected[].ranges from disk (Homebrew/brew#23112), so a hand-corrected fixed boundary survives. Drop the blanket "do not edit by hand".
Contributor
There was a problem hiding this comment.
Pull request overview
Adds a CONTRIBUTING.md guide intended to be the canonical “How to contribute” documentation for this Homebrew OSV advisory database, describing both the generated-from-homebrew/core path and the curated-direct-PR path.
Changes:
- Document how to get an advisory auto-generated by adding
resolves "CVE-..."annotations tohomebrew/coreformula patches. - Document how to contribute a curated OSV JSON advisory directly under
advisories/, including an example record and placeholder ID workflow. - Document project scope and link to the Homebrew Code of Conduct.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
p-linnane
approved these changes
Jul 14, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Add a contribution guide covering both paths into this database: annotating a
homebrew/corepatch withresolvesso a record is auto-generated, and opening a PR with a curated OSV record for cases the generator can't express (chiefly unfixed vulnerabilities). Follows the RustSec/PyPA pattern of a placeholder id assigned on merge.This is the doc the ossf/osv-schema
BREWprefix "How to contribute" link will point at. Per Homebrew/homebrew-brew-vulns#111 this repo stays as the canonical curated source.brew generate-vulns-advisoriesemitsdatabase_specific: {source: "generated"}and preservespublished/rangeson merge — vulns/osv_export: merge into existing records instead of overwriting brew#23112regenerate.ymlstops wiping — Regenerate via brew generate-vulns-advisories #2