OAPE-958: compliance: convert analyze-cve command to a skill

.claude-plugin/marketplace.json

@@ -294,7 +294,7 @@
       "name": "compliance",
       "source": "./plugins/compliance",
       "description": "Security compliance and vulnerability analysis tools for Go projects",
-      "version": "0.3.2",
+      "version": "0.4.0",
       "category": "security",
       "keywords": [
         "cve",

plugins/compliance/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "compliance",
   "description": "Security compliance and vulnerability analysis tools for Go projects",
-  "version": "0.3.2",
+  "version": "0.4.0",
   "author": {
     "name": "chiragkyal"
   }

plugins/compliance/README.md

@@ -2,15 +2,17 @@
 
 Security compliance and vulnerability analysis tools for Go projects.
 
-## Command
+## Skill
 
-### `/compliance:analyze-cve <CVE-ID> | --jira=<PROJ-NNN> | --jql="..." [--repo=<url-or-component>] [--algo=vta|rta|cha|static] [--auto-approve=yes|no]`
+### `analyze-cve`
+
+`/compliance:analyze-cve <CVE-ID> | --jira=<PROJ-NNN> | --jql="..." [--repo=<url-or-component>] [--algo=vta|rta|cha|static] [--auto-approve=yes|no]`
 
 Resolves and clones the affected Go repository, then analyzes it to determine CVE impact with multi-level confidence assessment. Can be driven directly by a CVE ID, or resolve the CVE (and the affected repository/branch) from a Jira ticket — single ticket or a JQL-selected queue — and, with approval, apply a fix and open a GitHub pull request.
 
 **Examples:**
 ```text
-/compliance:analyze-cve CVE-2024-24783 --repo=https://github.com/golang/net
+/compliance:analyze-cve CVE-2024-24783 --repo=https://github.com/openshift/hypershift
 /compliance:analyze-cve --jira=OCPBUGS-12345
 /compliance:analyze-cve --jql="project = OCPBUGS AND labels = needs-cve-analysis ORDER BY created ASC"
 ```
@@ -41,10 +43,10 @@ claude --print "/compliance:analyze-cve --jql=\"project = OCPBUGS AND labels = n
 
 ## Verification Levels
 
-The command uses multiple methods with increasing confidence:
+The skill uses multiple methods with increasing confidence:
 
 1. **Dependency check** → Confirms package presence
-2. **Static analysis** → Finds function usage  
+2. **Static analysis** → Finds function usage
 3. **govulncheck** → Official Go vulnerability scanner
 4. **Call graph reachability** → Proves execution path (HIGHEST confidence)
 5. **Context analysis** → Checks security controls
@@ -61,14 +63,14 @@ Jira/PR features require an Atlassian MCP server (or `jira-cli`) and, for PR cre
 
 ## Repository Resolution
 
-The command always analyzes a **cloned repository** (`REPO_DIR`, under `.work/compliance/analyze-cve/repos/`) — it does not analyze whatever directory it happens to be invoked from. Resolution order (see [Phase 0.7](commands/analyze-cve.md#phase-07-repository-resolution-and-cloning) for full detail):
+The skill always analyzes a **cloned repository** (`REPO_DIR`, under `.work/compliance/analyze-cve/repos/`) — it does not analyze whatever directory it happens to be invoked from. Resolution order (see [Phase 0.7](skills/analyze-cve/references/implementation.md#phase-07-repository-resolution-and-cloning) for full detail):
 
-1. A repo already cloned into `.work/compliance/analyze-cve/repos/` by a previous run (used automatically if there's exactly one, and `--repo=` wasn't passed)
+1. A repo already cloned into `.work/compliance/analyze-cve/repos/` by a previous run — in **direct-CVE mode**, reused automatically if there's exactly one and `--repo=` wasn't passed; in **Jira/JQL mode**, that sole candidate is validated against the ticket's resolved image and branch before reuse, not assumed
 2. `--repo=<url>` — a full GitHub URL, used directly
 3. `--repo=<short-name>` or a Jira ticket's extracted image name — resolved to a repo URL + branch via the [image-repo-mapping](skills/image-repo-mapping/SKILL.md) skill's static component table (including release repos that pin components as git submodules)
-4. Otherwise, the command prompts for a repo URL or image name (or hard-fails under `--auto-approve=yes`, since guessing a repo is a correctness risk, not a convenience trade-off)
+4. Otherwise, the skill prompts for a repo URL or image name (or hard-fails under `--auto-approve=yes`, since guessing a repo is a correctness risk, not a convenience trade-off)
 
-The [image-repo-mapping](skills/image-repo-mapping/SKILL.md) table is scoped to the components this command has been validated against — extend it as new components come up.
+The [image-repo-mapping](skills/image-repo-mapping/SKILL.md) table is scoped to the components this skill has been validated against — extend it as new components come up.
 
 ## Runtime Configuration
 
@@ -77,7 +79,7 @@ The [image-repo-mapping](skills/image-repo-mapping/SKILL.md) table is scoped to
 
 ## Prerequisites
 
-**Required for all modes.** The command exits with an error if any are missing.
+**Required for all modes.** The skill exits with an error if any are missing.
 
 ```bash
 # Install all required Go tools
@@ -100,15 +102,15 @@ brew install graphviz  # macOS
 - `gh` (authenticated via `gh auth login`) - required only to create/update a GitHub PR (Phase 6)
 - An Atlassian MCP server or `jira-cli` - required only for `--jira=`/`--jql=` input modes and posting reports back to Jira
 
-The command validates required tools in Phase 0 and provides installation instructions if any are missing.
+The skill validates required tools in Phase 0 and provides installation instructions if any are missing.
 
 ## Fallback Mode
 
-If internet access fails, the command prompts for manual CVE information (description, affected packages, versions, fixes). Analysis proceeds with user-provided data, clearly marked in the report. In `--auto-approve=yes` mode there is no one to prompt, so this case exits with an error instead of fabricating CVE details.
+If internet access fails, the skill prompts for manual CVE information (description, affected packages, versions, fixes). Analysis proceeds with user-provided data, clearly marked in the report. In `--auto-approve=yes` mode there is no one to prompt, so this case exits with an error instead of fabricating CVE details.
 
 ## Autonomous Mode
 
-`--auto-approve=yes` answers every yes/no approval prompt in the pipeline (proceed past `NEEDS_REVIEW`, apply fixes, create a PR, post to Jira with reduced visibility if restricted posting isn't available) so the command can run end-to-end unattended. It never bypasses hard-fail safety checks: embargoed Jira tickets, ambiguous CVE matches within a ticket, or a fix-file allowlist that can't be determined all stop the run regardless of this flag. See the [`analyze-cve` command's Autonomous Mode section](commands/analyze-cve.md#autonomous-mode---auto-approveyesno) for the full decision table.
+`--auto-approve=yes` answers every yes/no approval prompt in the pipeline (proceed past `NEEDS_REVIEW`, apply fixes, create a PR, post to Jira with reduced visibility if restricted posting isn't available) so the skill can run end-to-end unattended. It never bypasses hard-fail safety checks: embargoed Jira tickets, ambiguous CVE matches within a ticket, or a fix-file allowlist that can't be determined all stop the run regardless of this flag. See the [`analyze-cve` skill's Autonomous Mode section](skills/analyze-cve/references/implementation.md#autonomous-mode---auto-approveyesno) for the full decision table.
 
 ## Report Includes
 
@@ -123,7 +125,7 @@ If internet access fails, the command prompts for manual CVE information (descri
 
 ### Basic usage
 ```text
-/compliance:analyze-cve CVE-2024-24783 --repo=https://github.com/golang/go
+/compliance:analyze-cve CVE-2024-24783 --repo=https://github.com/openshift/hypershift
 ```
 Clones the repo, analyzes it for the crypto/x509 vulnerability, provides upgrade command if affected.
 

plugins/compliance/skills/analyze-cve/SKILL.md

@@ -0,0 +1,114 @@
+---
+name: analyze-cve
+description: |
+  Full Go CVE analysis workflow. Given a CVE identifier -- supplied directly, or
+  resolved from a Jira ticket or JQL batch -- resolves and clones the affected
+  repository, gathers vulnerability intelligence, analyzes codebase impact with
+  govulncheck and call-graph reachability, generates a risk report, and optionally
+  applies a fix and opens a GitHub pull request.
+  Use when the user gives a CVE ID (CVE-YYYY-NNNNN), a Jira ticket (--jira=), or a
+  JQL query (--jql=) for Go CVE triage; wants call-graph proof that a vulnerable
+  function is reachable; or wants an automated fix and PR for a Go dependency
+  vulnerability.
+  Triggers on: 'analyze CVE', 'CVE impact', 'is this repo affected by CVE',
+  'Go vulnerability analysis', 'triage this Jira CVE ticket', 'fix this CVE and
+  open a PR', or a bare CVE-YYYY-NNNNN identifier.
+---
+
+# analyze-cve
+
+Performs comprehensive security vulnerability analysis for Go projects. Given a CVE identifier — supplied directly, or resolved from a Jira ticket — it resolves and clones the affected repository, gathers vulnerability intelligence, analyzes the codebase for impact, generates a risk report, optionally applies fixes, and optionally opens a GitHub pull request after a verified fix.
+
+Explicit invocation uses the following argument syntax:
+
+```
+/compliance:analyze-cve <CVE-ID> [--repo=<url-or-component>] [--algo=vta|rta|cha|static] [--auto-approve=yes|no]
+/compliance:analyze-cve --jira=<PROJ-NNN> [--repo=...] [--algo=...] [--auto-approve=yes|no]
+/compliance:analyze-cve --jql="<JQL query>" [--repo=...] [--algo=...] [--auto-approve=yes|no]
+```
+
+Repository resolution works in four ways, in priority order: (1) an explicit `--repo=` (full URL or short image/component name), (2) in direct-CVE mode only, exactly one pre-cloned repository already present in this workspace's `repos/` directory when `--repo=` was not passed — in Jira/JQL mode that sole candidate is instead validated against the ticket's resolved image/branch before reuse, never assumed, (3) an image name extracted from a Jira ticket's summary/labels/custom fields when `--jira=`/`--jql=` was used, or (4) an interactive prompt for the repository URL or image name. See [Phase 0.7](references/implementation.md#phase-07-repository-resolution-and-cloning) in the implementation reference for the full resolution and cloning logic.
+
+Designed for both interactive use and headless execution (e.g. `claude --print "/compliance:analyze-cve --jira=OCPBUGS-12345 --auto-approve=yes"`) for scheduled/periodic runs.
+
+## Arguments
+
+Exactly one of the following input modes is required:
+
+- **`<CVE-ID>`** — Direct CVE identifier (format: `CVE-YYYY-NNNNN`, case-insensitive). Use when you already know the CVE.
+- **`--jira=PROJ-NNN`** — Jira ticket key (e.g. `--jira=OCPBUGS-12345`). This skill fetches the ticket and extracts the CVE ID, affected image name, and enrichment context (CVSS, CWE, priority, workarounds) from it.
+- **`--jql="..."`** — JQL query (e.g. `--jql="project = OCPBUGS AND labels = needs-cve-analysis"`). Fetches a batch of matching issues, filters out any already labeled `ai-cve-analyzed`, and processes exactly **one** of the remainder per run (see [Phase 0.3](references/implementation.md#phase-03-jql-resolution-only-when---jql-is-provided)). Re-running the same JQL periodically works through the queue over multiple invocations.
+
+Optional flags:
+
+- **`--repo=<url-or-component>`**: Repository to analyze. Accepts:
+  - A full GitHub URL: `--repo=https://github.com/openshift/cert-manager-operator`
+  - A short image/component name: `--repo=cert-manager-operator-rhel9` (resolved via the [image-repo-mapping](../image-repo-mapping/SKILL.md) skill)
+  - If omitted, Phase 0.7 checks for exactly one pre-cloned repo in this workspace first, then resolves from the Jira ticket's image name (if `--jira`/`--jql` was used), then prompts the user.
+- **`--algo`** (default: `vta`): Call graph construction algorithm.
+  - `vta` — Most precise, fewest false positives (recommended)
+  - `rta` — Good balance of precision and speed
+  - `cha` — Fast, less precise
+  - `static` — Fastest, least precise
+- **`--auto-approve=yes|no`** (default: `no`): Run end-to-end without interactive approval prompts. See [Autonomous Mode](references/implementation.md#autonomous-mode---auto-approveyesno) in the implementation reference. Intended for scheduled/headless runs.
+
+## Running This Skill
+
+Read and follow [`references/implementation.md`](references/implementation.md) for the full phase-by-phase procedure once the arguments above are parsed — do not paraphrase or improvise it. It covers, in order:
+
+1. **Autonomous Mode** — the full `AUTO_APPROVE` decision table (what's gated vs. what always hard-fails)
+2. **Security — Credential Handling** — rules that apply to every command this skill runs
+3. **Runtime Configuration** — `AI_HELPERS_WORKSPACE`, `FORK_ORG`
+4. **Implementation** — Phase 0 (setup) through Phase 6 (PR creation), including the Repo Guard and each sub-skill's input/output contract
+5. **Return Value** — the report format this skill produces
+
+## Examples
+
+1. **Basic CVE analysis against an explicit repo**:
+   ```
+   /compliance:analyze-cve CVE-2024-45338 --repo=https://github.com/openshift/cert-manager-operator
+   ```
+
+2. **With specific algorithm**:
+   ```
+   /compliance:analyze-cve CVE-2024-45338 --repo=https://github.com/openshift/cert-manager-operator --algo=rta
+   ```
+
+3. **Starting from a Jira ticket (repo/branch resolved automatically from the ticket's image name)**:
+   ```
+   /compliance:analyze-cve --jira=OCPBUGS-12345
+   ```
+
+4. **Unattended run from a JQL queue, applying fixes and opening a PR without prompts**:
+   ```bash
+   claude --print "/compliance:analyze-cve --jql=\"project = OCPBUGS AND labels = needs-cve-analysis ORDER BY created ASC\" --auto-approve=yes"
+   ```
+
+## Prerequisites
+
+All tools below are **required**. This skill exits with an error if any are missing.
+
+```bash
+# Install all required Go tools
+go install golang.org/x/vuln/cmd/govulncheck@latest
+go install golang.org/x/tools/cmd/callgraph@latest
+go install golang.org/x/tools/cmd/digraph@latest
+
+# git is also required (Phase 0.7 repository cloning) — install via your OS package manager
+```
+
+**Optional**:
+- `graphviz` for visual call graph generation (`brew install graphviz` or `sudo apt-get install graphviz`)
+- `gh` (GitHub CLI, authenticated via `gh auth login`) for Phase 6 pull-request creation. Missing `gh` does **not** fail Phase 0 — analysis and local fixes still run; Phase 6 is skipped until it's available.
+- An Atlassian MCP server (e.g. the `jira` plugin's bundled Rovo MCP) or `jira-cli` for `--jira=`/`--jql=` input modes and posting reports back to Jira
+
+**Internet access** is recommended for CVE data fetching but not required if you can provide CVE details manually.
+
+## Notes
+
+- Focuses on Go-specific vulnerabilities.
+- Resolves and clones the target repository automatically — via `--repo=`, Jira image-name mapping, or reusing a repo already cloned into `.work/compliance/analyze-cve/repos/` by a previous run — see [Phase 0.7](references/implementation.md#phase-07-repository-resolution-and-cloning). All analysis and fix-application phases run against that cloned `REPO_DIR`, not the directory this skill happened to be invoked from.
+- Falls back to user-provided information if internet access fails.
+- Does NOT make changes, commits, or pull requests without explicit approval — either interactive, or given once upfront via `--auto-approve=yes` (see [Autonomous Mode](references/implementation.md#autonomous-mode---auto-approveyesno)).
+- Reports are saved locally (`.work/compliance/analyze-cve/`, gitignored) and not committed to git — see [Runtime Configuration](references/implementation.md#runtime-configuration) to relocate this base directory.
+- Never process or disclose embargoed CVEs — if a Jira ticket's Embargo Status is `True`, this skill stops immediately and outputs nothing about the ticket.