docs: add <framework> placeholder; update Python invocations to use it#3
Merged
Conversation
After PR 2 ported the generate-cve-json Python implementation into
the framework, skill files invoke it from the path
`tools/vulnogram/generate-cve-json` — which resolves correctly in
framework standalone (where `cwd` is the repo root) but not in
adopting projects (where the framework is at the
`.apache-steward/apache-steward/` submodule path and `tools/` is
nowhere near `cwd`).
This commit introduces a `<framework>` placeholder that resolves
to:
- `.apache-steward/apache-steward/` in adopting projects (the
submodule path);
- `.` (the repo root) in framework standalone.
Skills now reference `uv run --project <framework>/tools/vulnogram/
generate-cve-json …`, which works in both contexts after the
agent's standard placeholder substitution.
Files updated:
- AGENTS.md — added a new row to the placeholder convention table
for `<framework>`.
- .claude/skills/{sync-security-issue,allocate-cve,deduplicate-
security-issue}/SKILL.md — 6 invocation sites updated.
- tools/vulnogram/generate-cve-json/SKILL.md — 3 invocation sites
updated; preamble note already in place from PR 2 calling out the
config-driven design.
- tools/vulnogram/generate-cve-json/README.md — documented the
dual-context invocation pattern with the placeholder.
Markdown LINKS to SKILL.md (e.g. `[generate-cve-json](../../../tools/
vulnogram/generate-cve-json/SKILL.md)`) are deliberately not
rewritten — those work via the .claude/skills/ symlink in adopters
because the kernel follows the symlink to the actual file location
and resolves the relative path from there.
Test plan:
- Pre-commit (`prek run --all-files`) passes after the changes.
- All 100 tests in the generate-cve-json package pass against the
test fixture config.
This is the framework-side counterpart to airflow-s PR 3
(delete-local-cve-json-after-port). After this lands and gets
merged, the airflow-s PR 3 needs a final commit to bump the
submodule pointer to this commit's SHA so adopting projects pick up
both PR 2 (the Python implementation) and this PR's skill text.
Generated-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
andreahlert
added
the
mode:platform
6 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
PR 2 ported the
generate-cve-jsonPython implementation into the framework. Skills currently invoke it viauv run --project tools/vulnogram/generate-cve-json …— works in framework standalone (cwd=repo root), but not in adopting projects, where the framework lives at the.apache-steward/apache-steward/submodule path.This PR introduces a
<framework>placeholder. Adopting projects substitute it to.apache-steward/apache-steward/; framework-standalone substitutes to.. Skills now reference<framework>/tools/vulnogram/generate-cve-jsoneverywhere they invoke the tool, and the path resolves in either context after the agent's standard placeholder substitution.Files updated
<framework>.Files NOT changed
Markdown links to SKILL.md (e.g.
[generate-cve-json](../../../tools/vulnogram/generate-cve-json/SKILL.md)) — those work via the.claude/skills/symlink in adopters because the kernel follows the symlink to the file's actual location and resolves the relative path from there.Test plan
Coordination
This is the framework-side counterpart to airflow-s/airflow-s#363 (
delete-local-cve-json-after-port). After this PR lands, airflow-s PR 3 needs one more commit to bump the submodule pointer to this PR's merge SHA — only then do skills work end-to-end on airflow-s.🤖 Generated with Claude Code