[potiuk]

dash.security.apache.org only tracks ASF projects, but asf-security-dash and the security-issue-sync dashboard section ran for any adopter. For a non-ASF project they would read the dashboard cookie and call an ASF service that knows nothing about the project.

Changes

• asf-security-dash CLI: a new required --project-md argument. The command exits with code 3 (NotAsf) unless the project's organization is exactly ASF. The check runs before the cookie is read or any request is made.
  • The value comes from the Identity table row, or an organization: line. HTML comments and fenced code are ignored, and the value must match in full, so ASFX, ASF-fork or a commented-out ASF row do not count. An annotated value such as `ASF` (derived: apache/ GitHub org) is accepted. A missing value or TODO counts as independent.
• issue-sync dashboard section: a new Step D0 makes the section ASF-only. For a project whose upstream is under apache/, it suggests setting organization: ASF with /magpie-setup:setup config. D1 and D3 pass --project-md and handle exit 3.
• Eval: security-issue-sync/step-d0-asf-only covers three cases: an ASF project, an independent project, and a TODO organization.

Testing

• asf-security-dash tests: 68 pass, including parametrized non-ASF and ASF organization cases.
• The full prek suite passes after rebasing on fix: mark and gate the remaining ASF-only surfaces #1796.

🤖 Generated with Claude Code