TR mirror drift in docs/reference/supply_chain_security.md: The artefacts are downloadable from the GitHub release page; gh release download v<X.Y.Z> --pattern 'sbom-*'; an auditor diffs against 'the… (DOC-TR04-011) #303

Wave 1 · theme D1-10: Documentation-only fixes · highest severity High · 1 finding(s) · effort docs fix

Summary

Neither. publish.yml:104-111 uploads each SBOM as a workflow artifact (actions/upload-artifact) of the publish run. The publish job only does a PyPI upload. Nothing attaches SBOMs to a GitHub release, so gh release download finds no sbom-* files, and workflow artifacts expire (default retention).

Primary finding

DOC-TR04-011 — TR mirror drift in docs/reference/supply_chain_security.md: The artefacts are downloadable from the GitHub release page; gh release download v<X.Y.Z> --pattern 'sbom-*'; an auditor diffs against 'the…

severity High · already tracked: KNOWN-OPEN OPS-02|OPS-03|OPS-04|OPS-05|OPS-06|OPS-15|OPS-16|OPS-19 docs/roadmap/phase-16-trust-surface-hardening.md:667-668

Where. EN docs/reference/supply_chain_security.md:41-42, 55-58, 62-66 · TR docs/reference/supply_chain_security-tr.md:41-42, 55-58, 63-65

English text. The artefacts are downloadable from the GitHub release page; gh release download v<X.Y.Z> --pattern 'sbom-*'; an auditor diffs against 'the artefact attached to the GitHub release'

Turkish text. Artefaktlar GitHub release sayfasından indirilebilir; gh release download v<X.Y.Z> --pattern 'sbom-*'; 'GitHub release'e ekli artefaktla diff alabilir'

Which is correct. Neither. publish.yml:104-111 uploads each SBOM as a workflow artifact (actions/upload-artifact) of the publish run. The publish job only does a PyPI upload. Nothing attaches SBOMs to a GitHub release, so gh release download finds no sbom-* files, and workflow artifacts expire (default retention).

Proposed correction (Turkish text for the -tr page). 'SBOM'lar release tag'ının publish workflow koşumunun Actions artefaktları olarak yüklenir (GitHub release sayfasına EKLENMEZ ve saklama süresi dolunca silinir); gh run download <run-id> --pattern 'sbom-*' ile indirin ve gerekirse kendi arşivinize alın.'

Acceptance criteria

• Each statement is re-checked against the code at fix time.
• Documentation listed above is corrected in English and in its Turkish mirror in the same PR.
• Every finding in this issue is resolved or explicitly closed with a reason.

_{Found by the October 2026 ForgeLM code and documentation review against commit cab2947. Code links point at that commit; line numbers may have moved since. Finding IDs (CR-…, DOC-…, TECH-…) are stable references for this backlog.}