Report Upstream

## Proposed fix

The diff below applies against commit `{suggested_fix_commit}`.

```diff
{suggested_fix}

When `suggested_fix` is empty, append `## Proposed fix\n\nNo patch is attached. {one sentence saying why: the patch skill has not run, or its output did not pass scrutineer's applicability gate.}` so the maintainer knows it was considered.

GitHub caps `description` at 65535 characters. If the assembled description exceeds that, drop the diff block (keep the prose explaining a diff is available on request) and try again. If it still exceeds the cap, truncate `disclosure_draft` from the bottom and note `truncated: true` in `report.json`.

End the description with a final line `[scrutineer-finding:{finding_id}]` so re-runs can recognise this advisory and the staging issue filed by `fork` carries the same marker.

## 2. File the report

This is the external-reporter endpoint; do not use the bare `/security-advisories` admin endpoint, which only works for repo admins. Capture `ghsa_id` and `html_url` from the response.

A 422 with `Private vulnerability reporting is disabled` means PVR was turned off between the precondition check and the POST; treat as a refusal. A 422 mentioning a specific field (`vulnerabilities`, `cvss_vector_string`) means the body shape was rejected; fix the named field (drop `vulnerable_version_range`, drop `cvss_vector_string` in favour of `severity`) and retry once. Any other non-2xx is a refusal with the response body in `error`.

## 3. Push the patch to the temporary private fork

The temporary private fork is created by GitHub when the maintainer accepts the report into draft, so it is usually not available to the reporter immediately. Poll for it briefly anyway in case it is:

Try up to six times with a five-second gap. If `private_fork` stays `null`, set `private_fork: null` and `patch_pushed: false` in `report.json` with `notes` explaining the maintainer has to accept the report before the fork exists; the diff is already in the description so they have it either way. Skip to step 4.

If a `private_fork.full_name` appears and `suggested_fix` is non-empty:

Read `suggested_fix` and the commit message (subject `Fix {ghsa_id}: {finding.title}`) into shell variables and pipe them through stdin rather than interpolating into the command line — finding titles can contain backticks, `$()`, or other shell-special characters. `gh auth setup-git` configures git's credential helper to use the gh token for github.com pushes; without it the push hangs on a credential prompt on any runner where it has not already been called.

If `git apply` fails the diff no longer applies cleanly to `suggested_fix_commit` as fetched; do not improvise a fix, set `patch_pushed: false` with the apply error in `notes`. If the push is rejected (no write access yet), same: `patch_pushed: false`, reason in `notes`.

If `suggested_fix` is empty, skip the push and record `patch_pushed: false` with `notes: "no gated patch on the finding"`.

## 4. Write back to scrutineer

All with `Authorization: Bearer {token}`:

- `PATCH {api_base}/findings/{finding_id}` with `{"fields": {"status": "reported"}, "by": "report-upstream"}`
- `POST {api_base}/findings/{finding_id}/references` with `{"url": "<html_url>", "tags": "ghsa-upstream", "summary": "PVR report {ghsa_id} on {owner}/{repo}"}`
- `POST {api_base}/findings/{finding_id}/communications` with `{"channel": "ghsa", "direction": "outbound", "actor": "report-upstream", "body": "<body>"}`. Build `<body>` as `Filed PVR report {ghsa_id} on {owner}/{repo}. ` followed by `Patch pushed to fix/{ghsa_id} on {private_fork}.` when `patch_pushed` is true, or `Patch included in the report description; private fork pending maintainer acceptance.` when false.

## Output

Write `./report.json`:

```json
{
  "upstream": "owner/repo",
  "ghsa_id": "GHSA-xxxx-xxxx-xxxx",
  "url": "https://github.com/owner/repo/security/advisories/GHSA-...",
  "private_fork": "owner/repo-ghsa-xxxx-xxxx-xxxx",
  "patch_pushed": true,
  "patch_branch": "fix/GHSA-xxxx-xxxx-xxxx",
  "truncated": false,
  "notes": "anything that did not go cleanly",
  "error": null
}