diff --git a/tools/security-tracker-stats-dashboard/README.md b/tools/security-tracker-stats-dashboard/README.md index a5732e391..f1c83c030 100644 --- a/tools/security-tracker-stats-dashboard/README.md +++ b/tools/security-tracker-stats-dashboard/README.md @@ -99,9 +99,11 @@ run is ~5–10 minutes on a 250-issue tracker; incremental re-renders 1. `default-config.yaml` (in this directory). 2. `$TRACKER_STATS_CONFIG` overlay YAML, when set (typically `/.apache-magpie-overrides/security-tracker-stats.yaml`). - Deep-merged with the default. **The `milestones` and `categories` - lists are REPLACED entirely** (not concatenated) — overlaying a - single category requires re-stating the whole list. + Deep-merged with the default. **Every list is REPLACED entirely** + (not concatenated) — `milestones`, `categories`, `bot_prefixes`, + `keywords`, and any other list-valued key. Overlaying a single + entry requires re-stating the whole list, otherwise the defaults + are silently dropped. 3. Env-var quick overrides for the most common knobs: `TRACKER_STATS_BUCKETS`, `TRACKER_STATS_START`, `TRACKER_STATS_UPSTREAM_REPO`. diff --git a/tools/security-tracker-stats-dashboard/default-config.yaml b/tools/security-tracker-stats-dashboard/default-config.yaml index 5581bc162..cb8c6b902 100644 --- a/tools/security-tracker-stats-dashboard/default-config.yaml +++ b/tools/security-tracker-stats-dashboard/default-config.yaml @@ -163,8 +163,15 @@ triage: - Security Model - cve-worthy - CVE-worthy + # Skill-authored comments, skipped when measuring human triage + # activity. The first entry is the canonical machine marker every + # framework skill writes (``); the + # rest are prose prefixes from older comment shapes. + # + # NOTE: this list is REPLACED wholesale by an overlay, not merged -- + # an overlay adding one prefix must restate the whole list. bot_prefixes: - - "