report-to-issues · git:20260406.90357d5 · 2026-04-06 · sha256 4fb143e27005a2c2
report-to-issues git:20260406.90357d5A

Name: report-to-issues
Author: northraystudio
Immutable. This exact content is served forever at /api/v1/blob/4fb143e27005a2c2.
---
name: report-to-issues
description: |
  Parses reports generated by the software-evaluation or vulnerability-scan skills and
  interactively registers selected tasks as GitHub Issues using the `gh` CLI.
  Use when the user wants to convert an evaluation report (docs/evaluation/*.md) or
  security audit report (docs/security-audit/*.md) into GitHub Issues.
  Triggers on requests like "create issues from report", "register tasks to GitHub",
  "convert report to issues", or when pointing at a specific report file.
---

## Workflow

### Phase 1: Locate Report

1. If the user specifies a file path, use it directly.
2. Otherwise, list available reports:
   - `docs/evaluation/` — software-evaluation reports
   - `docs/security-audit/` — vulnerability-scan reports
   - If multiple exist, ask the user to select one.
3. Detect report type by content:
   - Contains `## Improvement Roadmap` → **evaluation report**
   - Contains `## Remediation Priority` → **security-audit report**

---

### Phase 2: Extract Tasks

**Evaluation report** — extract rows from `## Improvement Roadmap` tables (P0–P3):

Each row yields:
- `priority`: P0 / P1 / P2 / P3
- `title`: Problem column (first sentence or file:line prefix)
- `problem`: full Problem cell
- `solution`: Solution cell
- `expected_outcome`: Expected Outcome cell

**Security-audit report** — extract from `## Remediation Priority` table AND individual `## Findings` sections:

Each row yields:
- `priority`: P0 / P1 from Priority column
- `title`: Finding column
- `action`: Action column
- `body`: full finding detail from the matching `### V-XX` section (Vulnerable Code, Attack Path, Risk Assessment, Recommended Fix)

---

### Phase 3: Present Tasks for Selection

Display all extracted tasks **before creating any issue**:

```
Extracted tasks from <report file>:

  1. [P0] <title> (<file:line if present>)
  2. [P1] <title>
  3. [P1] <title>
  ...

Which tasks would you like to register as GitHub Issues?
Enter numbers (e.g. 1 3 5), a range (e.g. 1-3), "all", or "none":
```

Wait for the user's response before proceeding.

---

### Phase 4: Ensure Labels Exist

Before creating issues, verify required labels exist. Required labels:

| Label | Color | When used |
|-------|-------|-----------|
| `software-evaluation` | `#0075ca` | Evaluation reports |
| `security-audit` | `#e4e669` | Security-audit reports |
| `P0` | `#d93f0b` | Priority 0 |
| `P1` | `#e99695` | Priority 1 |
| `P2` | `#f9d0c4` | Priority 2 |
| `P3` | `#fef2c0` | Priority 3 |
| `critical` | `#b60205` | Critical severity findings |
| `high` | `#d93f0b` | High severity findings |
| `medium` | `#e4e669` | Medium severity findings |
| `low` | `#0e8a16` | Low severity findings |

Check and create missing labels:

```bash
gh label list --json name | jq -r '.[].name'
gh label create "<label>" --color "<hex>" --description "<desc>"
```

---

### Phase 5: Create Issues

For each selected task, write the body to a temp file then create the issue:

```bash
cat > /tmp/issue_body.md << 'EOF'
<body markdown>
EOF

gh issue create \
  --title "<title>" \
  --body-file /tmp/issue_body.md \
  --label "<label1>" \
  --label "<label2>"
```

**Title format**:
- Evaluation: `[<Priority>] <problem summary>`
- Security: `[<Priority>] <finding title>`

**Body format — evaluation task**:

```markdown
## Problem
<problem>

## Solution
<solution>

## Expected Outcome
<expected_outcome>

---
*Source: <report file path>*
```

**Body format — security finding**:

```markdown
## Finding
<full finding detail: Vulnerable Code, Attack Path, Risk Assessment>

## Recommended Fix
<recommended fix>

## Action
<action from Remediation Priority table>

---
*Source: <report file path>*
```

**Labels per issue**:
- Always add report-type label: `software-evaluation` or `security-audit`
- Always add priority label: `P0`, `P1`, `P2`, or `P3`
- Security findings: also add severity label (`critical`, `high`, `medium`, `low`)

Check exit code after each `gh issue create`. If non-zero, report the error and continue with remaining tasks.

---

### Phase 6: Summary

After all issues are created, output:

```
Registered N / M issues:
  #<number>  <title>  <URL>
  #<number>  <title>  <URL>
  ...

Skipped: <any that failed with reason>
```

---

## Quality Gate

- [ ] Report file exists and type is correctly detected
- [ ] All extracted tasks shown to user before any issue is created
- [ ] User selection confirmed
- [ ] Labels verified / created before issue creation
- [ ] Each `gh issue create` exit code checked
- [ ] Final summary lists all created issue URLs