feat: request CVE reviews from on-call engineers

Author: brendan-kellam

.github/cve-reviewers.json

@@ -0,0 +1,4 @@
+{
+  "4252e0fc-68f3-4b81-91d1-b07fd6dd7983": "brendan-kellam",
+  "82990144-8a05-46bb-9712-775afc04b14d": "BlueBottleLatte"
+}

.github/prompts/cve-remediation-system.md

@@ -17,6 +17,7 @@ Required workflow:
 6. Verify the final dependency graph contains no affected version for every issue in the group. Run the repository's relevant tests, lint, typecheck, and build commands in proportion to the change.
 7. Open a pull request only when the remediation is complete, scoped, and supported by the verification. If no safe fix exists, or verification fails for reasons caused by the change, do not open a speculative PR.
 8. Put every advisory identifier in the PR title or body. Put each Linear issue on its own exact line in the PR body as `Fixes SOU-123`. This is mandatory because it creates the Linear PR attachment and lets Linear close the issue on merge.
-9. Do not mark Linear issues complete yourself. Do not merge the PR. Do not make unrelated refactors or upgrades.
+9. After opening or updating a pull request, re-fetch every Linear issue covered by that PR and collect its current `assigneeId`. Read the trusted Linear-to-GitHub mapping from `.cve-remediation-workflow/.github/cve-reviewers.json`, then request review from every distinct mapped assignee with `gh pr edit "$PR_URL" --add-reviewer "$REVIEWER"`. Do not infer a GitHub username from a name or email address. If an issue is unassigned, its assignee is not mapped, or a review request fails, keep the completed PR open and report the omission clearly instead of failing or deleting the PR.
+10. Do not mark Linear issues complete yourself. Do not merge the PR. Do not make unrelated refactors or upgrades.
 
 When more than one package group is supplied, complete each safe group independently. A failure or lack of a safe fix for one group must not force unrelated changes into another group's PR.

.github/scripts/test-cve-remediation.sh

@@ -6,6 +6,8 @@ FILTER="$SCRIPT_DIR/filter-unlinked-cve-issues.jq"
 DISCOVERY_SCRIPT="$SCRIPT_DIR/find-unlinked-cve-issues.sh"
 WORKFLOW_FILE="$SCRIPT_DIR/../workflows/_cve-remediation.yml"
 CALLER_WORKFLOW_FILE="$SCRIPT_DIR/../workflows/cve-remediation.yml"
+SYSTEM_PROMPT_FILE="$SCRIPT_DIR/../prompts/cve-remediation-system.md"
+REVIEWER_MAP_FILE="$SCRIPT_DIR/../cve-reviewers.json"
 
 assert_json() {
   local description="$1"
@@ -262,6 +264,11 @@ assert_json \
   "$(jq -c '.variables.after' "$FAKE_CURL_PAYLOAD_DIR/3.json")" \
   '"next-page"'
 
+assert_json \
+  "maps Linear on-call assignees to GitHub reviewers" \
+  "$(jq -c . "$REVIEWER_MAP_FILE")" \
+  '{"4252e0fc-68f3-4b81-91d1-b07fd6dd7983":"brendan-kellam","82990144-8a05-46bb-9712-775afc04b14d":"BlueBottleLatte"}'
+
 assert_workflow_contains \
   "uses the deterministic discovery script before Claude" \
   '.cve-remediation-workflow/.github/scripts/find-unlinked-cve-issues.sh'
@@ -289,6 +296,20 @@ assert_workflow_contains \
 assert_workflow_contains \
   "loads the CVE system prompt" \
   '--append-system-prompt-file'
+assert_workflow_contains \
+  "checks out the trusted reviewer map" \
+  '.github/cve-reviewers.json'
+assert_workflow_contains \
+  "requires reviewer assignment after PR creation" \
+  'gh pr edit "$PR_URL" --add-reviewer "$REVIEWER"' \
+  "$SYSTEM_PROMPT_FILE"
+assert_workflow_contains \
+  "uses the Linear assignee as the reviewer source" \
+  'current `assigneeId`' \
+  "$SYSTEM_PROMPT_FILE"
+assert_workflow_contains \
+  "allows the agent to request GitHub reviewers" \
+  'Bash(gh pr *)'
 assert_workflow_contains \
   "allows enough turns for multi-issue remediation batches" \
   '--max-turns 250'

.github/workflows/_cve-remediation.yml

@@ -119,7 +119,9 @@ jobs:
         with:
           repository: ${{ inputs.workflow_asset_repository || github.repository }}
           ref: ${{ inputs.workflow_asset_ref || github.sha }}
-          sparse-checkout: .github/prompts/cve-remediation-system.md
+          sparse-checkout: |
+            .github/prompts/cve-remediation-system.md
+            .github/cve-reviewers.json
           path: .cve-remediation-workflow
           persist-credentials: false