security_watch: a GitHub Actions advisory is not listed; an empty fix with a closed range reads 'after X' (R-1310 part; test W9, red first)

scripts/security_watch.py

@@ -191,6 +191,11 @@ def ghsa_affects(adv, ours, repo=""):
         pkg = (vul.get("package") or {}).get("name") or ""
         if only and not only.search(pkg.strip()):
             continue
+        # A GitHub Actions advisory is about the project's own CI workflow, never the image we run (R-1310: Home
+        # Assistant's GHSA-jff5, 2023). Pinned: test W9.
+        if ((vul.get("package") or {}).get("ecosystem") or "").lower() == "actions":
+            verdicts.append(False)
+            continue
         r = range_affects(vul.get("vulnerable_version_range"), ours, pkg)
         p = patched_for(vul.get("patched_versions"), ours)
         if p is not None and vcmp(ours, p) >= 0 and r is not False:
@@ -200,7 +205,12 @@ def ghsa_affects(adv, ours, repo=""):
         verdicts.append(r)
         if r:
             pv = (vul.get("patched_versions") or "").strip()
-            fixed.append(pv if pv and pv.lower() not in ("none", "tbd", "n/a") else "no fixed version named yet")
+            if not pv or pv.lower() in ("none", "tbd", "n/a"):
+                # An empty fix with a range that ENDS at a version means „fixed after it" (R-1310: Vikunja's six,
+                # `>= 2.3.0, <= 2.6.0`, were fixed in 2.7.0 and read „no fix"). Pinned: test W9.
+                end = re.search(r"<=?\s*v?(\d+(?:\.\d+)+)\s*$", vul.get("vulnerable_version_range") or "")
+                pv = ("a version after %s (the notice names none)" % end.group(1)) if end else "no fixed version named yet"
+            fixed.append(pv)
     if any(v is True for v in verdicts):
         return True, ", ".join(sorted(set(fixed)))
     if not verdicts or all(v is False for v in verdicts):