MOB-53942: Move vulnerability_history.md out of .claude/, fix jq buffering and Copilot reviewer fallback

[henrychv]

Summary

• Move vulnerability_history.md from .claude/skills/prisma-taurus/ to the repo root (git mv, content unchanged). Confirmed empirically — including with the exact pinned CLAUDE_CODE_VERSION=2.1.197 — that headless/dontAsk runs are denied all write access (Edit, Write, and Bash-based writes alike) to anything under .claude/, a hard, tool-agnostic guardrail no --allowed-tools/--add-dir combination changes. SKILL.md's path references, git add command, and the reference table updated to match.
• Force line-buffered jq output (--unbuffered) in Jenkinsfile-vulnerability-ai — without it, jq fully buffers stdout when piped to a non-TTY (always true in a Jenkins sh step), so VERBOSE_OUTPUT rendered a long-running invocation as one silent gap followed by a burst of messages at the end, indistinguishable from a hang in the console.
• Fix the Copilot reviewer request: gh pr edit --add-reviewer @copilot routes through GraphQL, a confirmed known no-op for bot logins — it can return exit 0 while silently attaching nothing. The previous ||-chained fallback to the REST requested_reviewers endpoint therefore never actually ran, since gh never reported failure. Only api call kept. Also notes not to verify attachment immediately afterward — even a successful REST call can show empty requested_reviewers for a long time, since Copilot's actual review can take far longer to start than any short check budgets for.

Test plan

• Confirmed the .claude/ write denial directly: Edit, Write, and Bash-based writes (redirects, sed -i, etc.) against a .claude/ path were all denied identically under --permission-mode dontAsk, with both the current CLI and the pinned 2.1.197.
• Confirmed the jq buffering fix locally with a synthetic slow producer: without --unbuffered, 5 messages spanning 10s of real time all land within 40ms of each other (fully buffered); with it, they land ~2s apart matching real time.
• Confirmed the Copilot GraphQL no-op directly against a real PR (taurus-cloud PR Nose Request, echoString command #833): gh pr edit --add-reviewer @copilot exited 0 twice while requested_reviewers stayed empty both times; the REST fallback separately returned 201 Created while also showing empty moments later (Copilot's actual review landed ~2h after the request).

🤖 Generated with Claude Code

[Copilot]

Copilot review overview

🟡 Changes recommended

The Copilot fallback and stale path references still require correction.

Get a fresh assessment by requesting another Copilot review.

Review effort: Lite
Findings: 1 · 1

Open (2)

• Prevent set-e failure from skipping the REST fallback · New
• Update stale Dockerfile references to the moved vulnerability history file · New

What changed in this PR

This PR relocates vulnerability history guidance, improves Jenkins output streaming, and updates Copilot reviewer requests.

Changes:

• Moves vulnerability_history.md to the repository root.
• Adds unbuffered jq output to vulnerability-pipeline stages.
• Runs the Copilot REST reviewer request independently.

File	Summary
vulnerability_history.md	Relocated vulnerability guidance.
Jenkinsfile-vulnerability-ai	Enables unbuffered progress output.
.claude/​skills/​prisma-taurus/​SKILL.md	Updates paths and reviewer instructions. Findings include fallback handling under set -e, generic REST failure messaging, and three stale Dockerfile references.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Copilot review overview

🟡 Changes recommended

Update the REST failure message to be cause-neutral and reconcile the documentation with the direct-REST flow.

Get a fresh assessment by requesting another Copilot review.

Review effort: Lite
Findings: 1

Open (1)

• Reconcile PR description with direct REST-only reviewer behavior · New

Resolved since last review (2)

• Prevent set-e failure from skipping the REST fallback
• Update stale Dockerfile references to the moved vulnerability history file

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 88.24%. Comparing base (17294ff) to head (6952bac).

Additional details and impacted files

@@           Coverage Diff           @@
##           master    #2030   +/-   ##
=======================================
  Coverage   88.24%   88.24%           
=======================================
  Files          75       75           
  Lines       21247    21247           
=======================================
  Hits        18748    18748           
  Misses       2499     2499           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.