feat: create separate PRs per branch for downstream repos in cve.fix

workflows/cve-fixer/.claude/commands/cve.find.md

@@ -51,59 +51,40 @@ Report: artifacts/cve-fixer/find/cve-issues-20260226-145018.md
    /cve.find "AI Evaluations" trustyai-ragas
    ```
 
-2. **Check JIRA API Token (REQUIRED - User Setup)**
-   - **This is the ONLY thing the user must configure manually before proceeding**
+2. **Verify Jira Access**
 
-   - Check if JIRA_API_TOKEN and JIRA_EMAIL are set:
-     ```bash
-     if [ -z "$JIRA_API_TOKEN" ]; then
-       echo "ERROR: JIRA_API_TOKEN is not set"
-     else
-       echo "JIRA_API_TOKEN is set"
-     fi
-     if [ -z "$JIRA_EMAIL" ]; then
-       echo "ERROR: JIRA_EMAIL is not set"
-     else
-       echo "JIRA_EMAIL is set"
-     fi
-     ```
-
-   - **If JIRA_API_TOKEN or JIRA_EMAIL is NOT set or empty**:
-     - **STOP here and inform the user they need to set up both variables first**
-     - Provide instructions:
-
-       **Step 1: Generate a Jira API Token**
-       - Go to https://id.atlassian.com/manage-profile/security/api-tokens
-       - Click "Create API token"
-       - Give it a name and copy the token
-
-       **Step 2: Export both environment variables**
-         ```bash
-         export JIRA_API_TOKEN="your-token-here"
-         export JIRA_EMAIL="your-email@redhat.com"
-         ```
-         To make it persistent, add to `~/.bashrc` or `~/.zshrc`:
-         ```bash
-         echo 'export JIRA_API_TOKEN="your-token-here"' >> ~/.bashrc
-         echo 'export JIRA_EMAIL="your-email@redhat.com"' >> ~/.bashrc
-         source ~/.bashrc
-         ```
-
-   - **After user sets the variables, verify they're exported correctly** using the check script above
-     - Should output: "JIRA_API_TOKEN is set" and "JIRA_EMAIL is set"
-
-   - **Only proceed to the next steps if both JIRA_API_TOKEN and JIRA_EMAIL are set**
+   Secrets may be injected by the Ambient session, a secrets manager, or an MCP server — do NOT rely solely on bash env var checks. Instead, attempt a lightweight test API call and let the response determine whether credentials are available.
+
+   ```bash
+   JIRA_BASE_URL="https://redhat.atlassian.net"
+   AUTH=$(echo -n "${JIRA_EMAIL}:${JIRA_API_TOKEN}" | base64)
+   TEST_RESPONSE=$(curl -s -o /dev/null -w "%{http_code}" -X GET \
+     --connect-timeout 10 --max-time 15 \
+     -H "Authorization: Basic ${AUTH}" \
+     -H "Content-Type: application/json" \
+     "${JIRA_BASE_URL}/rest/api/3/myself")
+   ```
+
+   - **HTTP 200** → credentials valid, proceed
+   - **HTTP 401** → credentials missing or invalid. Only now inform the user:
+     - Check if `JIRA_API_TOKEN` and `JIRA_EMAIL` are configured as Ambient session secrets
+     - If not, generate a token at https://id.atlassian.com/manage-profile/security/api-tokens and export:
+       ```bash
+       export JIRA_API_TOKEN="your-token-here"
+       export JIRA_EMAIL="your-email@redhat.com"
+       ```
+   - **HTTP 403** → token valid but insufficient permissions — inform user
+   - **Other / timeout** → network issue — inform user and retry once
+
+   **Do NOT pre-check env vars with `[ -z "$JIRA_API_TOKEN" ]` and stop.** The variables may be available to the API call even if not visible to the shell check (e.g. Ambient secrets injection).
 
 3. **Query Jira for CVE Issues**
 
-   a. Set up variables:
+   a. Set up variables (AUTH already set from Step 2):
    ```bash
    COMPONENT_NAME="[from step 1]"
    JIRA_BASE_URL="https://redhat.atlassian.net"
-   JIRA_EMAIL="${JIRA_EMAIL}"
-   JIRA_API_TOKEN="${JIRA_API_TOKEN}"
-   # Jira Cloud uses Basic Auth: base64(email:api-token)
-   AUTH=$(echo -n "${JIRA_EMAIL}:${JIRA_API_TOKEN}" | base64)
+   # AUTH already constructed in Step 2 — reuse it
    ```
 
    b. Construct JQL query and execute API call:

workflows/cve-fixer/.claude/commands/cve.fix.md

@@ -140,34 +140,122 @@ Summary:
    - The CVE scan in Step 5 acts as the safety net — it will skip repos where the CVE doesn't exist
    - Log a warning: "⚠️ Could not extract container from summary — processing all component repos"
 
-   **3.3: For each target repo, gather:**
-   - Repository name (e.g., "opendatahub-io/odh-dashboard")
-   - Default branch (e.g., "main")
-   - Active release branches (e.g., ["v2.29.0-fixes", "v2.28.0-fixes", "rhoai-3.0"])
-   - Primary target branch for CVE fixes (from `cve_fix_workflow.primary_target`)
-   - Backport targets from `cve_fix_workflow`
-   - Repository type (monorepo vs single package)
-   - Repo type: upstream or downstream (from `repo_type` field, defaults to upstream if absent)
-
-   **Multi-repo strategy**: When a container chain has upstream, midstream, and downstream repos:
-   - Fix upstream first, then apply the same fix to midstream and downstream
-   - Each repo gets its own clone, branch, PR, and verification cycle
-   - Steps 4 through 11 are repeated for EACH repository in the list
+   **3.3: For each target repo, determine target branches:**
+
+   The branches to fix depend on `repo_type`:
+
+   - **`upstream` or `midstream`**: target `default_branch` only (e.g., `main`)
+     - Fixes flow forward from there — no backports needed at this level
+   - **`downstream`**: target `default_branch` AND every branch in `active_release_branches`
+     - Each branch gets its own separate PR — never combine multiple branches in one PR
+     - If `active_release_branches` is empty, target `default_branch` only
+
+   ```bash
+   # Determine target branches per repo
+   if [ "$REPO_TYPE" = "downstream" ]; then
+     TARGET_BRANCHES=("$DEFAULT_BRANCH" "${ACTIVE_RELEASE_BRANCHES[@]}")
+   else
+     TARGET_BRANCHES=("$DEFAULT_BRANCH")
+   fi
+   ```
+
+   **Example for llm-d inference-scheduler:**
+   ```
+   upstream  llm-d/llm-d-inference-scheduler          → PR against: main
+   midstream opendatahub-io/llm-d-inference-scheduler  → PR against: main
+   downstream red-hat-data-services/llm-d-inference-scheduler → PRs against:
+     - main
+     - rhoai-3.3
+     - rhoai-3.4
+     - rhoai-3.4-ea.1
+     - rhoai-3.4-ea.2
+   ```
+
+   **Multi-repo + multi-branch strategy**:
+   - Fix upstream repos first, then midstream, then downstream
+   - For downstream: Steps 4 through 11 repeat for EACH branch independently
+   - Each branch produces its own PR with its own fix branch (e.g., `fix/cve-YYYY-XXXXX-<package>-rhoai-3.4-attempt-1`)
+   - Never combine fixes for multiple branches into a single PR
 
 4. **Clone or Use Existing Repository**
-   - Always use `/tmp` for repository operations with unique dirs per repo
-   - For each repo, extract `REPO_ORG` and `REPO_NAME` from `github_url`, set `REPO_DIR="/tmp/${REPO_ORG}/${REPO_NAME}"`
-   - If `$REPO_DIR` exists, `cd` into it; otherwise `mkdir -p "/tmp/${REPO_ORG}"`, `git clone` the URL, `cd` in, and `git checkout` the target branch
-   - **Configure git credentials** immediately after clone (needed for push):
-     1. `gh auth setup-git` (if `gh` is authenticated)
-     2. Else set `credential.helper` using `$GITHUB_TOKEN` or `$GH_TOKEN`
-     3. Else switch remote to SSH if `~/.ssh/id_rsa` or `id_ed25519` exists
-     4. Else warn: no credentials configured, push will fail
-   - **Multi-repo example**:
-     ```bash
-     # Upstream:  /tmp/opendatahub-io/models-as-a-service  (branch: main)
-     # Downstream: /tmp/red-hat-data-services/models-as-a-service  (branch: rhoai-3.0)
-     ```
+
+   **4.0: GitHub Authentication Setup**
+
+   Use a **Classic Personal Access Token (PAT)** with `repo` scope. This is the most reliable option across all repo types (upstream external orgs, midstream ODH, downstream RHDS):
+
+   ```bash
+   # Recommended: Classic PAT with repo scope
+   # Generate at: https://github.com/settings/tokens (classic)
+   # Required scopes: repo (full control of private repositories)
+   export GITHUB_TOKEN="ghp_your_classic_pat_here"
+   gh auth login --with-token <<< "$GITHUB_TOKEN"
+   ```
+
+   **Why Classic PAT?**
+   - Fine-grained PATs require org-level approval for `red-hat-data-services`, `opendatahub-io` etc.
+   - The Ambient Code GitHub App only covers repos where it is installed — it will NOT work for upstream repos like `llm-d/*`, `eval-hub/*`, `trustyai-explainability/*`
+   - Classic PAT with `repo` scope works immediately for any repo you are a member of
+
+   **4.1: Clone and detect write access**
+
+   For each repo:
+   ```bash
+   REPO_ORG=$(echo "$GITHUB_URL" | sed 's|https://github.com/||' | cut -d/ -f1)
+   REPO_NAME=$(echo "$GITHUB_URL" | sed 's|https://github.com/||' | cut -d/ -f2)
+   REPO_FULL="${REPO_ORG}/${REPO_NAME}"
+   REPO_DIR="/tmp/${REPO_ORG}/${REPO_NAME}"
+
+   # Clone the repo
+   mkdir -p "/tmp/${REPO_ORG}"
+   gh repo clone "$REPO_FULL" "$REPO_DIR" -- --depth=1 2>/dev/null || \
+     git clone "https://github.com/${REPO_FULL}.git" "$REPO_DIR"
+
+   # Check if user has write (push) access
+   PUSH_ACCESS=$(gh api repos/${REPO_FULL} --jq '.permissions.push' 2>/dev/null)
+   ```
+
+   **4.2: Fork fallback if no write access**
+
+   If `PUSH_ACCESS` is `false` or the push fails:
+   ```bash
+   # Create a fork under the authenticated user's account
+   gh repo fork "$REPO_FULL" --clone=false
+
+   FORK_USER=$(gh api user --jq '.login')
+   FORK_REPO="${FORK_USER}/${REPO_NAME}"
+
+   # Add fork as a remote
+   cd "$REPO_DIR"
+   git remote add fork "https://github.com/${FORK_REPO}.git"
+
+   # Push fix branch to fork, PR targets the original repo
+   git push fork "$FIX_BRANCH"
+   gh pr create --repo "$REPO_FULL" --head "${FORK_USER}:${FIX_BRANCH}" \
+     --base "$TARGET_BRANCH" --title "..." --body "..."
+   ```
+
+   This is common for upstream repos (`llm-d/*`, `eval-hub/*`, `trustyai-explainability/*`) where the user doesn't have direct write access.
+
+   **4.3: Branch loop**
+
+   Steps 5–11 run in a loop over `TARGET_BRANCHES` — for each branch:
+   - `git checkout <branch>` and `git pull` to ensure it is up to date
+   - Apply fix and create PR targeting that branch (from fork if no direct push access)
+
+   **Example for downstream with 4 active branches:**
+   ```bash
+   # Clone once: /tmp/red-hat-data-services/llm-d-inference-scheduler
+   # User has write access → push directly, 5 PRs:
+   # PR 1 → base: main
+   # PR 2 → base: rhoai-3.3
+   # PR 3 → base: rhoai-3.4
+   # PR 4 → base: rhoai-3.4-ea.1
+   # PR 5 → base: rhoai-3.4-ea.2
+
+   # Clone once: /tmp/llm-d/llm-d-inference-scheduler
+   # User has NO write access → fork + 1 PR:
+   # PR 1 → head: <user>/llm-d-inference-scheduler:fix/... → base: main
+   ```
 
 4.5. **Load Global Fix Guidance from `.cve-fix/` Folder**
    - Runs ONCE after all repos are cloned, BEFORE any fixes. Builds a global knowledge base from `.cve-fix/` folders across all cloned repos.