tree c744179ea1e1d2a50438da635e54d9a6a0cc218a
parent c5e69da6b7be3ee4af59fcdb1aceda8374592a6d
author Tatiana Bradley <tatianabradley@google.com> 1731428919 -0500
committer Tatiana Bradley <tatianabradley@google.com> 1732116537 +0000

internal/report: add new status NEEDS_REVIEW

Add a new YAML report status, NEEDS_REVIEW, which indicates that
a report has been automatically generated but needs to be reviewed
by a human later.

The goal of this new status is to allow us to quickly publish initial
versions of *most* reports that will require review.

A report with status NEEDS_REVIEW has slightly stricter requirements
than UNREVIEWED reports:
    - NEEDS_REVIEW reports must have a fixed version for each affected module
    - NEEDS_REVIEW reports must not have any "unsupported_versions"

These stricter requirements prevent us from publishing low-information reports
that could affect many users. Auto-generated reports that do not meet these
requirements need to be manually reviewed by a human.

When a new NEEDS_REVIEW report is committed, the automatically generated
commit message includes "Updates #NNN" for the corresponding issue instead
of "Fixes #NNN", because additional action is still needed.

NEEDS_REVIEW is an internal status only - it is converted to UNREVIEWED
when published to OSV.

Change-Id: I340279f5a3f73e508b145f613d3d07d71e870aaa
Reviewed-on: https://go-review.googlesource.com/c/vulndb/+/626157
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
Reviewed-by: Damien Neil <dneil@google.com>