Repository navigation
Conversation
…ot release assets The supply-chain reference, the deployer guide, the change-management SOP and the user-manual pages told an auditor to run `gh release download ... --pattern 'sbom-*'` and to re-emit the SBOM from the git tag and diff it against the one attached to the release. publish.yml only uploads the twelve files as workflow-run artifacts (90-day retention), so there is nothing on a Release page, and the SBOM is the CI runner's `pip list` taken after pytest and, on Linux, three extras were installed: test tooling is listed, there is no dependency graph and no licence data (checked on the real v0.11.0 SBOM: 130 components, pytest and pytest-cov among them). It cannot be reproduced from the tag, because dependencies resolve from PyPI at build time. The pages now give commands that work (`gh run list --workflow publish.yml --branch v<X.Y.Z> --status success`, then `gh run download`; the layout was checked against the v0.11.0 run), say what the file contains, and drop "license extraction in SBOM" from ISO A.5.32, SOC 2 CC9.2 and the statement of applicability. The nightly pip-audit is described as querying PyPI's vulnerability data (its default service; the workflow passes no --vulnerability-service), and "exit 1" in the manual now includes UNKNOWN-severity findings, which the reference page already said. Attaching SBOMs to the release and generating them from a clean runtime-only environment are code changes and stay open. Refs #114 Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
|
Sorry @cemililik, you've used your own review budget of 250,000 diff characters for the last 7 days. You can request another review in 13 hours and 1 minute by commenting |
Contributor
|
Warning Review limit reachedEnable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. Next included review available in 4 minutes. View limit details
Comment |
Reviewer's GuideThis documentation-only PR corrects the SBOM audit story across English and Turkish references, guides, SOPs, compliance mappings, and operator manuals: SBOMs are 90-day workflow-run artifacts rather than GitHub Release assets, represent the CI runner’s installed package set without dependency or licence data, are not reproducible from a tag alone, and use PyPI vulnerability data with UNKNOWN findings treated as failures. Flow diagram for SBOM contents and reproducibilityflowchart LR
Tag[Release tag] --> Publish[publish.yml]
Publish --> Runner[CI matrix runner]
Runner --> Install[Install wheel and extras]
Install --> PipList[pip list]
PipList --> SBOM[CycloneDX SBOM]
SBOM --> Artifact[Workflow-run artifact]
Artifact -->|90-day retention| Archive[Deployer archives artifact]
SBOM --> Limits[No dependency graph<br/>No licence data<br/>Test tooling included]
Tag --> Later[Later re-emission]
Later --> Mismatch[May differ: dependencies resolve from PyPI at build time]
File-Level Changes
Possibly linked issues
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
3 of 4 tasks
Collaborator
Author
|
Superseded by #1000: the wave-0 fixes are combined by theme into five pull requests to cut the review load. This branch's commits are included there unchanged apart from the |
cemililik
added a commit
that referenced
this pull request
Oct 18, 2026
… six-language site copy, described as the code behaves (#1000) ## Summary Compliance- and privacy-facing wording corrected to what the code does, plus the six-language site copy that repeated the same claims. Six earlier branches combined into one pull request, replacing #983, #986, #988 and #991 (to be closed as superseded) and two branches that were never opened. **This is compliance wording; please read the before/after tables.** ##⚠️ Localization exception `docs/standards/localization.md` keeps German, French, Spanish and Chinese as deferred tiers and says not to machine-translate them. At the owner's decision I **wrote the DE / FR / ES / ZH site strings myself**, with no native review. English and Turkish are authoritative; the other four need a native reader before they can be trusted. A follow-up issue for that is drafted, not yet filed. ## Related issues Refs #73, #99, #90, #94, #101, #87, #114, #75, #86, #89, #92, #98, #110, #112. The code halves stay open: whether the gate should ever compare trainer and approver, failing closed on a missing safety verdict (breaking), attaching SBOMs to the release. ## Changes | Theme | Said | Now says | |---|---|---| | **Segregation of duties** (ISO 27001 / SOC 2 mappings, SoA, SOP, deployer guide, manual) | the approval gate "enforces trainer ≠ approver", "dual-controlled" | it **records** trainer and approver identities and does not compare them; both are self-asserted; keeping them different people is the deployer's control. `require_human_approval` is not enforced for strict tiers by `ConfigError` (it only is when safety evaluation is off) | | **GDPR / KVKK manual page** | identifiable subjects are removed; "no specific person's data is recoverable from the model"; an `international_transfers` setting; audit report with source attribution and SHA-256 manifest; retention "auto-deletes originals" | eight identifier formats are masked, names and free text are not; the report is counts and summaries, not written to the audit log; retention is reported, not enforced; memorisation is not measured | | **No-verdict safety evaluation** (8 documents + TR) | exit 0 ⇒ every gate passed; classifier load failure halts the run; classification errors count as unsafe | a safety evaluation that produced no verdict (`evaluation_completed: false`) keeps the model and exits 0 (4 with the approval gate) regardless of `auto_revert`; code unchanged | | **SBOM** (reference, SOP, guides, manuals, mappings) | `gh release download …`; "re-emit from the git tag"; "licence extraction in SBOM" | workflow-run artifacts, 90-day retention; `gh run download`; the file is the CI runner's `pip list` (test tooling included, no dependency graph, no licences) | | **Article 12 / 14** (audit-event catalogue, audit-log and human-oversight pages) | the audit log is "mandated by Article 12"; the gate "implements" Article 14 | the log is development-time evidence that supports Annex IV; Article 12 logging and Article 14 in-use oversight belong to the deployed system | | **Site, six languages** | benchmark failure "fails (exit 3)"; "dual-controlled"; Slack/Teams/Discord; "PII redacted"; "satisfying the access-request side of the GDPR"; wizard "Enforce automatic deletion"; "SHA-256 manifest"; DeepSpeed "presets" | exit 3 only with `auto_revert: true`; records the approver; Slack-format, Teams and Discord need a relay; common formats masked, names not detected; reverse-pii finds only what is literally in the scanned files; retention mode reserved; SHA-256 sidecar; bring your own DeepSpeed JSON | The site GGUF strings describe the `.sha256` sidecar, the retention strings the reserved mode, and the DeepSpeed strings the preset caveat; they match the GGUF, code and docs pull requests, so **merge those first**. A new site test keeps the retired phrases out of English, Turkish and the HTML (mutation-checked). ### What this changes for a deployer A DPIA or audit response can no longer cite ForgeLM for: segregation of duties being enforced, personal data being removed or unrecoverable from the model, the SBOM being on the release page, or the audit log being the Article 12 mechanism. ## Type - [x] Documentation (and site copy) ## Testing - The full `CLAUDE.md` gauntlet from a clean worktree of this branch: exit 0. (An earlier run failed `tests/test_turkish_glossary_terms.py` because the Article 12 rewrite wrote "Ek IV" instead of "Annex IV", fixed here, then two timing-based regex linearity tests failed while two gauntlets ran at once; they pass alone and in this final run.) - `node --test tests/site/*.test.cjs`: 81 pass; English ↔ Turkish keys in lockstep. ## Checklist - [x] English and Turkish updated together (Turkish wording needs the owner's review) - [ ] DE / FR / ES / ZH reviewed by a native speaker — **not done** - [x] CHANGELOG entries under `[Unreleased]` 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Sonnet 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Auditors were told to run
gh release download v<X.Y.Z> --pattern 'sbom-*'and to "re-emit the SBOM from the git tag and diff it against the one attached to the release". Nothing attaches an SBOM to a GitHub Release.publish.ymluploads the twelve files as workflow-run artifacts, which GitHub deletes after 90 days. This says so, gives commands that work, and says what the file actually contains.Related issues
Refs #114 — the documentation half. Attaching the SBOMs to the release and generating them from a clean, runtime-only environment are code changes and stay open on the issue. (The project owner decided not to upload historical SBOMs to Releases, so the pages describe the workflow artifact.)
Changes — each row shows what it said and what it says now
docs/reference/supply_chain_security{,-tr}.mdgh release download …publish.ymlrun, 90-day retention;gh run list --workflow publish.yml --branch v<X.Y.Z> --status success, thengh run download <id> --name sbom-ubuntu-latest-py3.11python3 tools/generate_sbom.pyin your environmentpip listafter installing the wheel, three Linux extras andpytest: it names test tooling, has no dependency graph and no licence datadocs/qms/sop_change_management{,-tr}.md§4.3git tag… attached to the GitHub release"docs/guides/iso_soc2_deployer_guide{,-tr}.md,docs/usermanuals/{en,tr}/operations/{iso-soc2-deployer,supply-chain}.mdgh release download "$(gh release view …)"gh run …commands above, with the 90-day notedocs/usermanuals/{en,tr}/operations/supply-chain.md, reference--vulnerability-service); exit 1 also covers UNKNOWN-severity findings, which the reference page already saidChecked
sbom-ubuntu-latest-py3.11): 130 components includingpytest,pytest-cov,pipandsetuptools; nolicenses, nodependencieskey.gh run list … --branch v0.11.0 --status successreturns the publish run;gh run download --name …writes the file directly into the target directory,--pattern 'sbom-*'writes one directory per artifact (both run against the live v0.11.0 artifacts).--vulnerability-serviceispypi.What this changes for a deployer
An audit answer can no longer cite "the SBOM attached to the release" or "licence extraction in the SBOM". The v0.11.0 artifacts expire on 2026-10-19; the maintainers kept a local copy of every release's SBOMs (they are not published).
Not done here
The site copy (
features.ent.sbom.body,compliance.iso.supply.body) says "emitted per release tag", which is true and unchanged.Type
Testing
CLAUDE.mdgauntlet from a clean worktree of this branch: exit 0.Checklist
[Unreleased]🤖 Generated with Claude Code
Summary by Sourcery
Correct supply-chain and compliance documentation to accurately describe SBOM storage, contents, reproducibility, and vulnerability scanning behavior.
Bug Fixes:
Enhancements:
CI:
Documentation:
Chores: