WackoWiki

View source for Maintainer-only — operational details

=== Appendix: Maintainer Operational Notes ===

==== Adding a GHSA reference to an already-committed fix ====

If the fix was committed before the GHSA ID was issued:

**Latest commit on the branch:**
%%(hl bash)
git commit --amend
# add GHSA-xxxx-xxxx-xxxx to the message body
git push --force-with-lease
%%

**Older commit (e.g., second-to-last):**
%%(hl bash)
git rebase -i HEAD~N   # N = commits back to the target
# change "pick" → "reword" on the target commit
# add GHSA-xxxx-xxxx-xxxx to the message
git push --force-with-lease
%%

**If you don't want to rewrite history** (shared branch, or just to keep it simple):
%%(hl bash)
git commit --allow-empty -m "ref: GHSA-xxxx-xxxx-xxxx"
%%

==== Force-push safety ====

##--force-with-lease## only overwrites the remote if its tip matches your local ##origin/<branch>##. If someone else pushed in the meantime, it's rejected. For a solo project this is a no-op safety check, but make it a habit.

**EGit caveat:** EGit may run a background ##git fetch## between your rebase and your push, which updates ##origin/master## to the new remote tip and silently nullifies the lease. For solo work this doesn't matter. On a shared repo, disable EGit's auto-fetch or use ##git push --force-if-includes## (Git 2.30+).

==== Dangling commits after rebase ====

After a reword rebase, the old commit becomes unreachable. On GitHub it shows the banner //"This commit does not belong to any branch on this repository."//
  - You **cannot** trigger GC on GitHub. It will be pruned on their schedule.
  - Locally, clean it up if it bothers you:
  %%(hl bash)
git reflog expire --expire-unreachable=now --all
  git gc --prune=now
%%
  - The "two commits with the same diff" you see in the GitHub commit list is the old (dangling) one. It won't appear in ##git log##, PRs, or clones. Ignore it.

==== GHSA auto-link timing ====

The GHSA ID in a commit message only resolves to a clickable link **after the advisory is published**. While the advisory is in draft, it renders as plain text. No re-push needed after publishing.

==== Updating the advisory after release ====

When you cut the release tag:
  1. Edit the published GHSA → set "Patched version" to the tag (e.g., ##v1.2.4##).
  2. Add the tag to the release notes / changelog with a link to the advisory.

You can edit a published GHSA at any time — there's no "re-publish" step.