Handle security changes

Author: aduh95

remark-lint-nodejs-yaml-comments.js

@@ -20,6 +20,7 @@ const MAX_SAFE_SEMVER_VERSION = semverParse(
 );
 const validVersionNumberRegex = /^v\d+\.\d+\.\d+$/;
 const prUrlRegex = new RegExp("^https://github.com/nodejs/node/pull/\\d+$");
+const privatePRUrl = "https://github.com/nodejs-private/node-private/pull/";
 
 const kContainsIllegalKey = Symbol("illegal key");
 const kWrongKeyOrder = Symbol("Wrong key order");
@@ -71,6 +72,30 @@ function invalidChangesKeys(change) {
     if (keys[index] !== changesExpectedKeys[index]) return true;
   }
 }
+function validateSecurityChange(file, node, change, index) {
+  if ("commit" in change) {
+    if (typeof change.commit !== "string" || isNaN(`0x${change.commit}`)) {
+      file.message(
+        `changes[${index}]: Ill-formed security change commit ID`,
+        node
+      );
+    }
+
+    if (Object.keys(change)[1] === "commit") {
+      change = { ...change };
+      delete change.commit;
+    }
+  }
+  if (invalidChangesKeys(change)) {
+    const securityChangeExpectedKeys = [...changesExpectedKeys];
+    securityChangeExpectedKeys[0] += "[, commit]";
+    file.message(
+      `changes[${index}]: Invalid keys. Expected keys are: ` +
+        securityChangeExpectedKeys.join(", "),
+      node
+    );
+  }
+}
 function validateChanges(file, node, changes) {
   if (!Array.isArray(changes))
     return file.message("`changes` must be a YAML list", node);
@@ -81,8 +106,14 @@ function validateChanges(file, node, changes) {
 
     const isAncient =
       typeof change.version === "string" && change.version.startsWith("v0.");
-
-    if (!isAncient && invalidChangesKeys(change)) {
+    const isSecurityChange =
+      !isAncient &&
+      typeof change["pr-url"] === "string" &&
+      change["pr-url"].startsWith(privatePRUrl);
+
+    if (isSecurityChange) {
+      validateSecurityChange(file, node, change, index);
+    } else if (!isAncient && invalidChangesKeys(change)) {
       file.message(
         `changes[${index}]: Invalid keys. Expected keys are: ` +
           changesExpectedKeys.join(", "),
@@ -100,7 +131,7 @@ function validateChanges(file, node, changes) {
       file.message(`changes[${index}]: list of versions is not in order`, node);
     }
 
-    if (!isAncient && !prUrlRegex.test(change["pr-url"])) {
+    if (!isAncient && !isSecurityChange && !prUrlRegex.test(change["pr-url"])) {
       file.message(
         `changes[${index}]: PR-URL does not match the expected pattern`,
         node