Document default values for CVE rule data keys in user-facing docs

[st3penta]

The defaults for rule data keys like restrict_cve_security_levels, warn_cve_security_levels, restrict_unpatched_cve_security_levels, warn_unpatched_cve_security_levels, and cve_leeway are defined in policy/lib/rule_data/rule_data.rego but are not clearly documented in the Antora-generated documentation.

Currently, the CVE package docs (antora/docs/modules/ROOT/pages/packages/release_cve.adoc) include:

• Prose mentions of defaults scattered across individual rule descriptions (e.g., "By default, only CVEs of critical and high security level cause a failure").
• An "Example rule data" YAML block that shows non-default values, which can be confused with the actual defaults.

However, there is no consolidated table or section that explicitly lists each key with its default value. The rule_data.rego file where defaults live is never linked from the docs.

Suggested improvements:

1. Add a "Default values" section to the CVE package documentation page that lists each rule data key with its actual default value in a table or YAML block clearly labeled as "Defaults" (not "Example").
2. Consider adding a cross-cutting "Rule Data Defaults Reference" page to the Antora docs that consolidates defaults for all rule data keys across all packages, linking to rule_data.rego as the source of truth.
3. Ensure the example YAML block is clearly distinguished from the defaults to avoid confusion.

Relevant code locations:

• Defaults: policy/lib/rule_data/rule_data.rego (lines 36-47)
• CVE policy: policy/release/cve/cve.rego
• CVE docs: antora/docs/modules/ROOT/pages/packages/release_cve.adoc
• Release policy overview: antora/docs/modules/ROOT/pages/release_policy.adoc

[fullsend-ai-triage]

🤖 Finished Triage · ✅ Success · Started 10:21 AM UTC · Completed 10:23 AM UTC
Commit: 47d3320 · View workflow run →

[fullsend-ai-triage]

Triage Summary

This is a well-specified documentation improvement request. The gap is clear: default values for CVE rule data keys live in rule_data.rego but are not consolidated in the user-facing Antora docs.

Problem: The CVE package docs scatter default information across prose descriptions, and the example YAML block can be confused with actual defaults.

Recommended approach:

1. Add a "Default values" table/section to the CVE docs page listing each key with its actual default from rule_data.rego (lines 36-47)
2. Clearly label the existing example YAML as non-default values
3. Optionally link to rule_data.rego as the source of truth

Related issue: #1205 covers the broader goal of documenting all rule data across all packages. This issue is a good concrete starting point for that effort — the CVE defaults could serve as a template for other packages.

Relevant files:

• policy/lib/rule_data/rule_data.rego (source of defaults)
• antora/docs/modules/ROOT/pages/packages/release_cve.adoc (docs to update)
• policy/release/cve/cve.rego (CVE policy rules)

Proposed test:
- Run `make generate-docs` after changes
- Verify the CVE docs page has a clearly labeled defaults section
- Verify the example YAML is distinguished from defaults
- Run `make ci` to confirm docs pass all checks

[fullsend-ai-coder]

🤖 Finished Code · ✅ Success · Started 10:25 AM UTC · Completed 10:42 AM UTC
Commit: 47d3320 · View workflow run →