version: "1.0.2" name: cve-fix description: Fix CVEs in Submariner Go repositories. Arguments are optional and order-independent. TRIGGER when user asks to fix CVEs, scan for vulnerabilities, or mentions grype/CVE/GHSA. argument-hint: "[branch] [repo]" user-invocable: true allowed-tools: Bash, Read context: fork

CVE Fix Workflow

Run the command below exactly as written. Do not read, debug, or modify the CVE scripts. If a bare repo name like subctl is passed, convert it to ../subctl before running.

#!/bin/bash
set -euo pipefail
 
# Find scripts directory (in shipyard repo)
CVE_SCRIPTS="$(pwd)/scripts/cve"
if [[ ! -d "$CVE_SCRIPTS" ]]; then
  CVE_SCRIPTS="$HOME/go/src/submariner-io/shipyard/scripts/cve"
fi
if [[ ! -d "$CVE_SCRIPTS" ]]; then
  echo "ERROR: Cannot find scripts/cve/ directory"
  echo "Expected in current directory or ~/go/src/submariner-io/shipyard/"
  exit 1
fi
 
exec bash "$CVE_SCRIPTS/fix-all.sh" $ARGUMENTS

fix-all.sh does everything: detect config, create fix branch, scan for CVEs, fix each deterministically, run tests, agent-review all results, and print the PR command.

Exit code 0: All CVEs addressed. Review commits and run the printed PR command.

Exit code 2: Some CVEs unresolved after review.

Exit code 1: Error.

Multi-Repo

For multiple repos, spawn one agent per repo. Each agent should run bash ~/go/src/submariner-io/shipyard/scripts/cve/fix-all.sh REPO BRANCH via the Bash tool (not the Skill tool, which times out in subagents). Report per repo: CVEs found, fixed, ignored, and PR command. On errors or timeout, clean up orphaned processes with bash ~/go/src/submariner-io/shipyard/scripts/cve/clean.sh before reporting. Never modify the CVE fix scripts themselves.

Usage

• /cve-fix - current repo, current branch
• /cve-fix 0.23 - current repo, specified branch (short form)
• /cve-fix ../submariner-operator - specified repo, current branch
• /cve-fix release-0.23 ../submariner-operator - both specified (order doesn't matter)

Arguments are order-independent. Short versions like 0.23 auto-expand to release-0.23. Repos must be paths. If a bare name like subctl is passed, resolve it to ../subctl (from any submariner repo) or ~/go/src/submariner-io/subctl.

From the command line (without Claude):

make cve-fix                                                      # current repo, current branch
make cve-fix BRANCH=release-0.23                                  # current repo, specified branch
make cve-fix REPO=../submariner-operator BRANCH=release-0.23      # specified repo and branch

Common Issues