feat: configure CVE issue assignees per repository

Author: msukkari

.github/workflows/vulnerability-triage.yml

@@ -43,6 +43,16 @@ on:
         required: false
         type: boolean
         default: false
+      linear_assignee_id:
+        description: 'Linear user UUID to assign. Leave empty to use assign_to_api_key_owner behavior.'
+        required: false
+        type: string
+        default: ''
+      assign_to_api_key_owner:
+        description: 'Assign issues to the Linear API key owner when linear_assignee_id is empty.'
+        required: false
+        type: boolean
+        default: true
     secrets:
       LINEAR_API_KEY:
         required: true
@@ -674,13 +684,19 @@ jobs:
           REPO_LABEL_ID: ${{ steps.match.outputs.repo_label_id }}
           STATE_ID: ${{ steps.match.outputs.state_id }}
           VIEWER_ID: ${{ steps.match.outputs.viewer_id }}
+          CONFIGURED_ASSIGNEE_ID: ${{ inputs.linear_assignee_id }}
+          ASSIGN_TO_API_KEY_OWNER: ${{ inputs.assign_to_api_key_owner }}
         run: |
           set -uo pipefail
-          # Team UUID, the "CVE" + repository labels, "Triage" state, and the API key
-          # owner's user ID were already resolved by the "Match existing Linear issues"
-          # step and passed in as env.
+          # Team UUID, the "CVE" + repository labels, "Triage" state, and assignee
+          # metadata were already resolved by the "Match existing Linear issues" step.
           STRUCTURED_OUTPUT=$(cat findings.json)
 
+          TARGET_ASSIGNEE_ID="$CONFIGURED_ASSIGNEE_ID"
+          if [ -z "$TARGET_ASSIGNEE_ID" ] && [ "$ASSIGN_TO_API_KEY_OWNER" = "true" ]; then
+            TARGET_ASSIGNEE_ID="$VIEWER_ID"
+          fi
+
           if [ -z "$LABEL_ID" ]; then
             echo "::warning::Could not find 'CVE' label in Linear team. Creating issues without label."
           fi
@@ -690,8 +706,8 @@ jobs:
           if [ -z "$STATE_ID" ]; then
             echo "::warning::Could not find 'Triage' state in Linear team. Using default state."
           fi
-          if [ -z "$VIEWER_ID" ]; then
-            echo "::warning::Could not resolve Linear API key owner. Issues will be created unassigned."
+          if [ -z "$TARGET_ASSIGNEE_ID" ]; then
+            echo "Issues will be created or reopened unassigned."
           fi
 
           # Map severity to Linear priority
@@ -751,8 +767,10 @@ jobs:
                 --arg issueId "$LINEAR_ISSUE_ID" \
                 --arg stateId "$STATE_ID" \
                 '{issueId: $issueId, stateId: $stateId}')
-              if [ -n "$VIEWER_ID" ]; then
-                REOPEN_VARIABLES=$(echo "$REOPEN_VARIABLES" | jq --arg aid "$VIEWER_ID" '. + {assigneeId: $aid}')
+              if [ -n "$TARGET_ASSIGNEE_ID" ]; then
+                REOPEN_VARIABLES=$(echo "$REOPEN_VARIABLES" | jq --arg aid "$TARGET_ASSIGNEE_ID" '. + {assigneeId: $aid}')
+              else
+                REOPEN_VARIABLES=$(echo "$REOPEN_VARIABLES" | jq '. + {assigneeId: null}')
               fi
               REOPEN_PAYLOAD=$(jq -n --arg query "$REOPEN_MUTATION" --argjson vars "$REOPEN_VARIABLES" '{query: $query, variables: $vars}')
 
@@ -796,8 +814,10 @@ jobs:
             if [ -n "$STATE_ID" ]; then
               VARIABLES=$(echo "$VARIABLES" | jq --arg sid "$STATE_ID" '. + {stateId: $sid}')
             fi
-            if [ -n "$VIEWER_ID" ]; then
-              VARIABLES=$(echo "$VARIABLES" | jq --arg aid "$VIEWER_ID" '. + {assigneeId: $aid}')
+            if [ -n "$TARGET_ASSIGNEE_ID" ]; then
+              VARIABLES=$(echo "$VARIABLES" | jq --arg aid "$TARGET_ASSIGNEE_ID" '. + {assigneeId: $aid}')
+            else
+              VARIABLES=$(echo "$VARIABLES" | jq '. + {assigneeId: null}')
             fi
 
             PAYLOAD=$(jq -n --arg query "$MUTATION" --argjson vars "$VARIABLES" '{query: $query, variables: $vars}')
@@ -827,4 +847,4 @@ jobs:
           if [ "$FAILED_COUNT" -gt 0 ]; then
             echo "::error::Failed to create $FAILED_COUNT Linear issue(s)"
             exit 1
-          fi
+          fi