Jira-to-GitHub CVE synchronization for keycloak-github-bot

[abstractj]

Summary

Enhance keycloak-github-bot to automatically synchronize CVE titles and descriptions from Jira issue trackers back to the corresponding GitHub issues, ensuring consistent data across both issue trackers and enabling future automation of release notes.

Problem statement

Today, the CVE workflow creates a disconnect between GitHub and Jira:

1. A CVE request is opened on GitHub and the bot updates the title to [CVE-TBD] ...
2. When secalert responds with an assigned CVE, the bot updates the title with the CVE ID (e.g., [CVE-2025-12345] ...)
3. However, the final title and description for the CVE are only written when the Jira/Bugzilla issue tracker is created and that information never flows back to GitHub

This means GitHub issues end up with incomplete data, while the final description lives only in Jira.

Proposed solution

Add bidirectional sync between Jira and GitHub:

1. The bot monitors Jira issues linked to CVEs — when a Jira issue is created or updated for a CVE already tracked on GitHub, the bot detects it
2. Title sync — the bot updates the GitHub issue title to match the finalized Jira title (preserving the [CVE-XXXX-XXXXX] prefix)
3. Description sync — the bot updates or appends the CVE description from Jira to the GitHub issue body (or a clearly marked section within it)
4. Sync trigger — this happens on a schedule (polling) considering that we don't have webhooks for it.

The current behavior is acceptable as-is, but we can do better.

Value & benefits

Benefit	Who benefits from it	Impact
Single source of truth	Security team, release engineering	No more manually cross-checking Jira and GitHub for accurate CVE info
Automation-ready data	Release engineering, tooling	GitHub becomes a reliable source for programmatically generating release notes
Reduced manual toil	Security team	No need to manually update GitHub issues when issue trackers are created on Jira
Auditability	Anyone reviewing CVE history	GitHub history shows when and how metadata changed

User stories / scenarios

Scenario: Jira issue finalized after CVE assignment

A vulnerability is reported. The security team requests a CVE to secalert; the bot marks it [CVE-TBD]. Secalert assigns CVE-2025-54321; the bot updates the title. Secalert creates the Jira issue tracker with the official title "OIDC session fixation via redirect_uri manipulation" and a full description. The bot detects this, updates the GitHub issue title to [CVE-2025-54321] OIDC session fixation via redirect_uri manipulation, and appends the description to the issue body.

Scenario: Release notes

At release time, automation queries GitHub for all issues in the CVE bundle. Because titles and descriptions are now synced from Jira, the automation can generate release notes without manual intervention (TBD in a separate issue).

Diagram

sequenceDiagram
    participant GH as GitHub Issue
    participant Bot as keycloak-github-bot
    participant SA as secalert
    participant Jira as Jira Issue Tracker

    Note over GH: Issue created
    Bot->>GH: Update title to [CVE-TBD]
    SA-->>Bot: CVE-2025-XXXXX assigned
    Bot->>GH: Update title to [CVE-2025-XXXXX]
    
    Note over Jira: Jira issue created with final title & description
    Bot->>Jira: Poll or webhook detects update
    Bot->>GH: Sync title and description from Jira

Loading

Acceptance criteria

• When a Jira issue linked to a tracked CVE is created or updated, the bot updates the corresponding GitHub issue title
• The GitHub issue title follows the format [CVE-XXXX-XXXXX] <Jira title>
• The GitHub issue body contains a clearly marked section with the synced CVE description from Jira
• If the Jira title or description changes, the GitHub issue is updated on the next sync cycle
• The bot logs sync actions
• Existing CVE request flow (TBD → assigned CVE) continues to work unchanged

Out of scope

• Syncing from GitHub to Jira (this is one-way: Jira → GitHub)
• Syncing any fields beyond title and description
• Modifying how CVE requests are created or how secalert responds
• Automated release note generation itself (this feature just makes the data available)

Discussion

No response

Motivation

No response

Details

No response