docs(skills): send CVE advisory mails from the ASF CVE tool

[lukaszlenart]

Follow-up to feedback from sebb and raboof on the S2-073 announcement thread.

What prompted this

The S2-070…S2-074 advisory mails were sent by hand from Gmail on 2026-08-14. The bodies were already the CVE tool's generated text — only the sending was hand-rolled, and that is where every failure came from:

Send	Outcome
S2-070, from the personal Gmail identity	Bounced — Must be sent from an @apache.org address.
S2-071…074, to user@ with announce@ in Cc/Bcc	Bounced — unacceptable MIME Content-Type: 'text/html' (#5.2.3)
The re-sends, to announce@ alone	Delivered, subjects hand-prefixed [ANN]

raboof asked why the Send these Emails button on cveprocess.apache.org wasn't used. sebb noted that ASF CVE reports don't carry an [ANN] prefix, and that mail sent through the tool is moderated automatically while a personal account waits for a human moderator.

The actual cause

CNA_private.userslist on the Struts records reads dev@struts.apache.org. That field is labelled "This is your project list such as users@ where you also want security announcement emails go to" — so the tool's generated ASF mail addressed announce@apache.org, dev@struts.apache.org and missed user@struts.apache.org, the list operators actually read. That is why the button looked inadequate and hand-sending looked necessary. It is a one-field fix.

(CNA_private.emailed is still null on all five records, confirming the button was never pressed.)

Changes

creating-security-bulletins/SKILL.md carries the substance. The announcement section becomes an ordered four-step recipe ending in Press Send these Emails, with the userslist fix as step 1. The Gmail path is demoted from a co-equal alternative to a conditional keyed to the button actually failing. Adds the subject rule (take the tool's CVE-YYYY-NNNNN: Apache Struts: … unedited — no [ANN], no - S2-XXX suffix) and a note that moderation delay is not a failed send.

The old text already said "use the tool's mails" and then documented a complete Gmail recipe underneath — the fallback is what got taken under time pressure. This replaces the recommendation with a recipe rather than adding another prohibition.

bulletin-template.md — userslist added to the pre-publication checklist.

releasing-struts/ — three lines only, deferring to the bulletin skill rather than restating it, per the principle #1848 established that the runbook holds only what the published guidelines cannot. Phase 6 gains one sentence guarding the release [ANN] prefix; phase 7 names the button and the no-[ANN] rule and points at the owning skill for the rest. Plus the phase 7 gate and one Common Mistakes row in SKILL.md.

Rebased onto #1848

#1848 landed after this branch was cut and moved the release process to the published Release Guidelines, cutting release-runbook.md by two thirds. This branch is rebased onto it.

Worth noting for review: git offered the deleted sections back as "our side" of the conflict — the site-PR section, the RESERVED → DRAFT → READY paragraph and the whole ## Post-release section. Those were dropped rather than resurrected, so this PR reverts nothing from #1848. The runbook diff against main is nine added lines and no removals.

Testing

Not tested against the live tool, deliberately: modifying an already-published CVE record is prohibited, and reserving a CVE that isn't needed is too. This will be exercised on the next advisory that needs one. Draft until then.

Every fact here was read off the tool on 2026-08-15 (read-only — no record was modified and no mail was sent).

🤖 Generated with Claude Code