Add @security reject command to close issues as rejected and reply to reporter

src/main/java/org/keycloak/gh/bot/labels/Status.java

@@ -10,7 +10,8 @@ public enum Status {
     TRIAGE,
     REOPENED,
     CVE_REQUESTED,
-    CVE_ASSIGNED;
+    CVE_ASSIGNED,
+    REJECTED;
 
     @Override
     public String toString() {

src/main/java/org/keycloak/gh/bot/security/SecurityBotCli.java

@@ -4,6 +4,7 @@
 import io.quarkiverse.githubapp.command.airline.CliOptions;
 import io.quarkiverse.githubapp.command.airline.CommandOptions;
 import org.keycloak.gh.bot.security.command.MailingListCommand;
+import org.keycloak.gh.bot.security.command.RejectCommand;
 import org.keycloak.gh.bot.security.command.SecAlertCommand;
 import org.keycloak.gh.bot.security.command.UnknownCommand;
 
@@ -12,6 +13,7 @@
         defaultCommand = UnknownCommand.class,
         commands = {
                 MailingListCommand.class,
+                RejectCommand.class,
                 SecAlertCommand.class,
                 UnknownCommand.class
         }

src/main/java/org/keycloak/gh/bot/security/command/MailingListCommand.java

@@ -10,7 +10,6 @@
 
 import java.io.IOException;
 import java.util.Optional;
-import java.util.regex.Pattern;
 
 /**
  * Replies to the keycloak-security mailing list and the original sender when invoked via @security reply.
@@ -19,8 +18,6 @@
 public class MailingListCommand extends CommandParser implements BotCommand {
 
     private static final Logger LOGGER = Logger.getLogger(MailingListCommand.class);
-    private static final Pattern THREAD_ID_PATTERN = Pattern.compile(
-            Pattern.quote(Constants.GMAIL_THREAD_ID_PREFIX) + "\\s*([a-f0-9]+)");
 
     @Inject
     MailSender mailSender;
@@ -33,7 +30,7 @@ protected void execute(GHEventPayload.IssueComment payload) throws IOException {
         Optional<ParsedMessage> msg = extractMessage(payload);
         if (msg.isEmpty()) return;
 
-        Optional<String> threadId = findThreadId(payload, THREAD_ID_PATTERN);
+        Optional<String> threadId = findThreadId(payload, Constants.GMAIL_THREAD_ID_PATTERN);
         if (threadId.isEmpty()) {
             fail(payload, "Gmail Thread ID not found in issue comments. Cannot reply without a linked email thread.");
             return;

src/main/java/org/keycloak/gh/bot/security/command/RejectCommand.java

@@ -0,0 +1,71 @@
+package org.keycloak.gh.bot.security.command;
+
+import com.github.rvesse.airline.annotations.Command;
+import jakarta.inject.Inject;
+import org.eclipse.microprofile.config.inject.ConfigProperty;
+import org.jboss.logging.Logger;
+import org.keycloak.gh.bot.labels.Status;
+import org.keycloak.gh.bot.security.common.Constants;
+import org.keycloak.gh.bot.security.email.MailSender;
+import org.keycloak.gh.bot.utils.Labels;
+import org.kohsuke.github.GHEventPayload;
+import org.kohsuke.github.GHIssue;
+import org.kohsuke.github.GHIssueStateReason;
+import org.kohsuke.github.GHLabel;
+
+import java.io.IOException;
+import java.util.Optional;
+import java.util.Set;
+import java.util.stream.Collectors;
+
+/**
+ * Rejects a security report by notifying the reporter via email, applying the rejected label, and closing the issue.
+ */
+@Command(name = "reject", description = "Rejects a security report, notifies the reporter, and closes the issue")
+public class RejectCommand extends CommandParser implements BotCommand {
+
+    private static final Logger LOGGER = Logger.getLogger(RejectCommand.class);
+
+    @Inject
+    MailSender mailSender;
+
+    @ConfigProperty(name = "google.group.target")
+    String targetGroup;
+
+    @Override
+    protected void execute(GHEventPayload.IssueComment payload) throws IOException {
+        Optional<ParsedMessage> msg = extractMessage(payload);
+        if (msg.isEmpty()) return;
+
+        GHIssue issue = payload.getIssue();
+        String reasoning = msg.get().body();
+
+        if (Labels.hasLabel(issue, Labels.SOURCE_EMAIL)) {
+            Optional<String> threadId = findThreadId(payload, Constants.GMAIL_THREAD_ID_PATTERN);
+            if (threadId.isEmpty()) {
+                fail(payload, "Gmail Thread ID not found in issue comments. Cannot reject without notifying the reporter.");
+                return;
+            }
+
+            LOGGER.infof("Sending rejection reply to Gmail thread %s for issue #%d", threadId.get(), issue.getNumber());
+
+            if (!mailSender.sendReply(threadId.get(), reasoning, targetGroup)) {
+                fail(payload, "Failed to send rejection reply via Gmail API.");
+                return;
+            }
+        } else {
+            LOGGER.infof("Issue #%d has no %s label. Skipping email notification.", issue.getNumber(), Labels.SOURCE_EMAIL);
+        }
+
+        Set<String> currentLabels = issue.getLabels().stream().map(GHLabel::getName).collect(Collectors.toSet());
+
+        issue.addLabels(Status.REJECTED.toLabel());
+
+        if (currentLabels.contains(Status.TRIAGE.toLabel())) {
+            issue.removeLabels(Status.TRIAGE.toLabel());
+        }
+
+        issue.close(GHIssueStateReason.NOT_PLANNED);
+        success(payload);
+    }
+}

src/main/java/org/keycloak/gh/bot/security/common/Constants.java

@@ -10,6 +10,8 @@ public final class Constants {
     public static final Pattern GHI_ISSUE_PATTERN = Pattern.compile("#GHI-(\\d{1,9})");
 
     public static final String GMAIL_THREAD_ID_PREFIX = "**Gmail-Thread-ID:**";
+    public static final Pattern GMAIL_THREAD_ID_PATTERN = Pattern.compile(
+            Pattern.quote(GMAIL_THREAD_ID_PREFIX) + "\\s*([a-f0-9]+)");
     public static final String SECALERT_THREAD_ID_PREFIX = "**SecAlert-Thread-ID:**";
     public static final String CVE_TBD_PREFIX = "[CVE-TBD]";
     public static final String ISSUE_DESCRIPTION_TEMPLATE = "_Thread originally started in the keycloak-security mailing list. Replace the content here with a proper CVE description._";

src/test/java/org/keycloak/gh/bot/labels/EnumTest.java

@@ -12,6 +12,7 @@ public void testToLabel() {
         Assertions.assertEquals("status/missing-information", Status.MISSING_INFORMATION.toLabel());
         Assertions.assertEquals("status/bumped-by-bot", Status.BUMPED_BY_BOT.toLabel());
         Assertions.assertEquals("label:status/missing-information", "label:" + Status.MISSING_INFORMATION);
+        Assertions.assertEquals("status/rejected", Status.REJECTED.toLabel());
         Assertions.assertEquals("kind/bug", Kind.BUG.toLabel());
         Assertions.assertEquals("label:kind/bug", "label:" + Kind.BUG);
     }
@@ -21,13 +22,15 @@ public void fromLabel() {
         Assertions.assertEquals(Priority.IMPORTANT, Priority.fromLabel("priority/important"));
         Assertions.assertEquals(Status.MISSING_INFORMATION, Status.fromLabel("status/missing-information"));
         Assertions.assertEquals(Status.BUMPED_BY_BOT, Status.fromLabel("status/bumped-by-bot"));
+        Assertions.assertEquals(Status.REJECTED, Status.fromLabel("status/rejected"));
         Assertions.assertEquals(Kind.BUG, Kind.fromLabel("kind/bug"));
     }
 
     @Test
     public void fromName() {
         Assertions.assertEquals(Priority.IMPORTANT, Priority.fromPriority("important"));
         Assertions.assertEquals(Status.MISSING_INFORMATION, Status.fromStatus("missing-information"));
+        Assertions.assertEquals(Status.REJECTED, Status.fromStatus("rejected"));
         Assertions.assertEquals(Kind.BUG, Kind.fromKind("bug"));
     }
 
@@ -44,6 +47,7 @@ public void isInstance() {
         Assertions.assertFalse(Priority.isInstance("something/important"));
         Assertions.assertFalse(Priority.isInstance("important"));
         Assertions.assertTrue(Status.isInstance("status/missing-information"));
+        Assertions.assertTrue(Status.isInstance("status/rejected"));
         Assertions.assertFalse(Status.isInstance("something"));
     }