Jira Cve Extraction

Jira CVE Extraction

Fetches a Jira ticket and extracts three things:

1. CVE ID — passed to Phase 1 (cve-intelligence-gathering)
2. Image name — passed to Phase 0.7 via the image-repo-mapping skill to resolve which repo to clone
3. Enriched context — CVSS, CWE, priority, target versions, workarounds — embedded in the Phase 3 report and used to seed the CVE profile

Key insight: Security tracking tickets (e.g. OCPBUGS CVE trackers) follow a consistent summary format: CVE-YYYY-NNNNN <component>: <description> [<version>]. Parsing the summary is the most reliable single extraction path and should always be tried first — it typically yields the CVE ID, image name, and branch in one step.

When to Use This Skill

Use this skill when the user invokes /compliance:analyze-cve with --jira=PROJ-NNN or --jql="...".

Prerequisites

Preferred: Atlassian MCP

Use the Atlassian Rovo MCP tools bundled with the jira plugin (or an equivalent Atlassian MCP server configured for this Claude Code instance):

• getJiraIssue — fetch a single ticket
• searchJiraIssuesUsingJql — fetch a batch of tickets (Phase 0.3 / idempotency lookups)
• editJiraIssue — update labels (idempotency marker)

Fallback: jira-cli

If the MCP server is unavailable: jira issue get <TICKET> and jira issue edit <TICKET> --label ... (from go-jira). Requires ~/.jira.d/config.yml configured for the target Jira instance.

Credential rule: Never print, echo, or log any token, password, or key value — not in shell commands, not in model responses, not in debug output. Reference credentials only via environment variable names (e.g. $JIRA_API_TOKEN).

Implementation Steps

Step 1: Validate Ticket Format

PROJECT-NNNNN   e.g. OCPBUGS-12345, CNTRLPLANE-678

Pattern: ^[A-Z]+-[0-9]+$

• IF invalid → Return error: "Invalid Jira ticket format. Expected PROJECT-NNNNN."
• IF valid → Continue

Step 2: Fetch the Ticket

issue = getJiraIssue(issue_key="PROJ-12345")

Fallback (jira-cli):

jira issue get PROJ-12345

Error Handling:

• 404 / not found → "Ticket not found. Verify the key and your access."
• Auth failure → IF AUTO_APPROVE=no, prompt user to authenticate and retry. IF AUTO_APPROVE=yes, exit with error — there is no credential to fix automatically.
• Network down → IF AUTO_APPROVE=no, ask the user to supply the CVE ID manually and skip the enrichment. IF AUTO_APPROVE=yes, exit with error (never gated — cannot fabricate ticket data).

Step 2.5: Idempotency Check — Already Processed?

Inspect the ticket's labels list from the response above. Check whether ai-cve-analyzed is present (case-sensitive exact match). This check always runs here regardless of entry point (--jira= direct or --jql= batch mode) — it is the authoritative guard against re-processing.

labels = issue["fields"]["labels"]   # list of strings
if "ai-cve-analyzed" in labels:
    # Already processed — exit immediately

IF label is present → Stop immediately and output:

⚠️ Skipping analysis — this ticket has already been processed by /compliance:analyze-cve.

Ticket:  <JIRA_KEY>
Label:   ai-cve-analyzed

To force a re-analysis, remove the label from the ticket and re-run.

Return status: skipped and exit. Do not proceed with analysis.

IF label is absent → Continue to Step 3.

Step 3: Extract CVE ID and Image Name from Summary

The ticket summary follows this common format:

CVE-YYYY-NNNNN <image-name>: <vulnerability description> [<branch-or-version>]

Example:

CVE-2024-45338 openshift4/ose-operator-sdk-rhel9: some-lib: vulnerability description [openshift-4.17]

Parse with:

^(CVE-\d{4}-\d{4,})\s+([\w/:\-\.@]+)\s*:.*\[([\w\.\-]+)\]
  group 1 = CVE ID
  group 2 = image name
  group 3 = branch/version

This is the primary and most reliable extraction path. If this succeeds, groups 1 and 2 are immediately available — no further searching needed for CVE ID or image name.

• IF summary matches → set CVE_ID, IMAGE_NAME, BRANCH → skip to Step 5
• IF summary does not match → continue to Step 4

Step 4: Fallback Extraction (when summary doesn't match)

Try in order until both CVE_ID and IMAGE_NAME are found:

CVE ID fallbacks:

1. A dedicated CVE ID custom field, if the project has one — always accurate when present
2. Labels — look for a label matching CVE-\d{4}-\d{4,} exactly
3. Description body — scan for CVE-\d{4}-\d{4,} pattern

Image name fallbacks:

1. pscomponent: label — parse pscomponent:<image-name> from the labels list; strip the pscomponent: prefix
2. Downstream Component Name custom field, if the project has one — dedicated field mapping directly to the affected image
3. Description body — scan for known image name prefixes (openshift4/, cert-manager/, external-secrets-operator/, zero-trust-workload-identity-manager/, redhat-user-workloads/)

Multiple CVE IDs found: List all found. IF AUTO_APPROVE=no → ask the user which to analyze (or analyze all with confirmation). IF AUTO_APPROVE=yes → always exit with error listing the candidates and asking the caller to re-run with a direct <CVE-ID> argument (or a ticket/JQL that resolves to a single CVE). This case is never gated by AUTO_APPROVE — guessing which CVE to analyze is a correctness risk.

Decision Point:

• IF no CVE ID found anywhere → IF AUTO_APPROVE=no, ask the user to supply it manually; if declined → Exit. IF AUTO_APPROVE=yes, there is no one to ask → Exit immediately with error (never gated by AUTO_APPROVE).
• IF no image name found → leave IMAGE_NAME blank; Phase 0.7 will prompt the user for --repo= (or hard-fail if AUTO_APPROVE=yes, per its own rules) — this is never guessed.

Step 5: Extract Additional Context Fields

Read the following fields from the ticket response. Field names vary by Jira instance/project — look them up by display name if the custom field ID is unknown (e.g. via issue-type field metadata), rather than hardcoding an ID that may not match this instance.

Scan description for workarounds: look for sections or sentences containing "workaround", "mitigation", "disable", "restrict" — extract the first ~300 chars of any such passage.

Linked issues:

issue["fields"]["issuelinks"]  # each has inwardIssue/outwardIssue + type.name