[Wave 4] Low/info — TR mirror: docs/reference/supply_chain_security.md #802

Wave 4 · 5 finding(s) in 5 fix package(s). English/Turkish mirror drift for this document pair; fix the side the finding names.

Findings

• DOC-TR04-042 (TR mirror, Low) — TR mirror drift in docs/reference/supply_chain_security.md: SPDX conversion is a one-line cyclonedx-py invocation.
  severity Low
  Where. EN docs/reference/supply_chain_security.md:21-22 · TR docs/reference/supply_chain_security-tr.md:21-22
  English text. SPDX conversion is a one-line cyclonedx-py invocation.
  Turkish text. SPDX'e dönüşüm ... tek satırlık bir cyclonedx-py çağrısıdır.
  Which is correct. Neither. cyclonedx-py generates BOMs from environments and is not a format converter. SPDX conversion needs a separate tool (e.g. cyclonedx-cli convert). Taken from the verified EN list; not re-run here.
  Proposed correction (Turkish text for the -tr page). 'SPDX gerekiyorsa, CycloneDX çıktısını cyclonedx-cli convert gibi ayrı bir dönüştürücüyle SPDX'e çevirin (ForgeLM bunu sağlamaz).'

• DOC-TR04-043 (TR mirror, Low) — TR mirror drift in docs/reference/supply_chain_security.md: pip-audit runs daily at 03:00 UTC on the closure/wave3-integration-derived development branch + main.
  severity Low
  Where. EN docs/reference/supply_chain_security.md:87-88 · TR docs/reference/supply_chain_security-tr.md:87-88
  English text. pip-audit runs daily at 03:00 UTC on the closure/wave3-integration-derived development branch + main.
  Turkish text. closure/wave3-integration-türetilmiş development branch + main'de her gün 03:00 UTC'de çalışır.
  Which is correct. Neither. nightly.yml:4-5 is a cron schedule (03:00 UTC), and scheduled workflows run only on the default branch. The closure branch name is stale.
  Proposed correction (Turkish text for the -tr page). 'Varsayılan branch'te (main) her gün 03:00 UTC'de çalışır (ayrıca elle tetiklenebilir: workflow_dispatch).'

• DOC-TR04-044 (TR mirror, Low) — TR mirror drift in docs/reference/supply_chain_security.md: Uses the OSV / GHSA databases (pip-audit's default).
  severity Low
  Where. EN docs/reference/supply_chain_security.md:111 · TR docs/reference/supply_chain_security-tr.md:113
  English text. Uses the OSV / GHSA databases (pip-audit's default).
  Turkish text. OSV / GHSA veritabanlarını kullanır (pip-audit varsayılanı).
  Which is correct. Neither. pip-audit's default vulnerability service is PyPI's advisory API. OSV is selectable with --vulnerability-service osv, and nightly.yml:322-325 does not pass it.
  Proposed correction (Turkish text for the -tr page). 'pip-audit varsayılan olarak PyPI güvenlik duyuru servisini kullanır (OSV için --vulnerability-service osv gerekir; nightly workflow bunu geçmez).'

• DOC-TR04-045 (TR mirror, Low) — TR mirror drift in docs/reference/supply_chain_security.md: Bandit severity policy: LOW / UNDEFINED -> silent.
  severity Low
  Where. EN docs/reference/supply_chain_security.md:167-171 · TR docs/reference/supply_chain_security-tr.md:169-173
  English text. Bandit severity policy: LOW / UNDEFINED -> silent.
  Turkish text. LOW / UNDEFINED → sessiz.
  Which is correct. Neither. tools/check_bandit.py:140-142 emits a summary ::warning::-style annotation with the count of UNDEFINED findings; only LOW is silent.
  Proposed correction (Turkish text for the -tr page). 'LOW → sessiz. UNDEFINED (önem derecesi metadata'sı olmayan kurallar) → tek bir özet annotation olarak raporlanır.'

• DOC-TR04-046 (TR mirror, Low) — TR mirror drift in docs/reference/supply_chain_security.md: pyproject.toml [tool.bandit] contains skips = ["B101"]
  severity Low
  Where. EN docs/reference/supply_chain_security.md:173-179 · TR docs/reference/supply_chain_security-tr.md:175-181
  English text. pyproject.toml [tool.bandit] contains skips = ["B101"]
  Turkish text. [tool.bandit]\nexclude_dirs = [...]\nskips = ["B101"] # assert_used — tests/ hariç tutulduğunda anlamsız
  Which is correct. Neither. pyproject.toml:327-328 has only exclude_dirs = ["tests", ".venv", "build", "dist"]; there is no skips key.
  Proposed correction (Turkish text for the -tr page). Kod bloğundan skips = ["B101"] satırını silin; yalnız exclude_dirs = ["tests", ".venv", "build", "dist"] kalsın.

Done when

• Every finding above is fixed or closed with a reason (tick it here).
• Code fixes carry a test; doc fixes update the Turkish mirror in the same PR.

_{Found by the October 2026 ForgeLM code and documentation review against commit cab2947. Code links point at that commit; line numbers may have moved since. Finding IDs (CR-…, DOC-…, TECH-…) are stable references for this backlog.}