aisbom-cli 1.1.0__tar.gz → 1.2.0__tar.gz

aisbom_cli-1.1.0/README.md → aisbom_cli-1.2.0/PKG-INFO

@@ -1,3 +1,28 @@
+Metadata-Version: 2.4
+Name: aisbom-cli
+Version: 1.2.0
+Summary: An AI Supply Chain security tool that that detects Pickle bombs and generates CycloneDX SBOMs for Machine Learning models.
+License-File: LICENSE
+Author: Ajoy L
+Author-email: lab700xdev@gmail.com
+Requires-Python: >=3.11,<4.0
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Programming Language :: Python :: 3.14
+Requires-Dist: click (<8.5.0)
+Requires-Dist: cyclonedx-python-lib (>=8.5,<12.0)
+Requires-Dist: packaging (>=24,<27)
+Requires-Dist: pip-requirements-parser (>=32.0.1,<33.0.0)
+Requires-Dist: requests (>=2.32.3,<3.0.0)
+Requires-Dist: rich (>=13.7.1,<16.0.0)
+Requires-Dist: spdx-tools (>=0.8.3,<0.9.0)
+Requires-Dist: typer[all] (>=0.12.5,<0.27.0)
+Project-URL: Homepage, https://www.aisbom.io/
+Project-URL: Repository, https://github.com/Lab700xOrg/aisbom
+Description-Content-Type: text/markdown
+
 # AIsbom: The Supply Chain for Artificial Intelligence
 
 [![PyPI version](https://img.shields.io/pypi/v/aisbom-cli.svg)](https://pypi.org/project/aisbom-cli/)
@@ -236,6 +261,23 @@ When the scan is clean, the comment collapses to a one-line ✅:
 
 Re-runs update the same comment in place via a hidden `<!-- aisbom-action -->` marker — you'll never see stacked AIsbom comments on the same PR.
 
+### Hosted dashboard (optional)
+
+The PR comment shows you each scan; the hosted dashboard at [app.aisbom.io](https://app.aisbom.io) keeps the history. Set the optional `token` input and every scan's SBOM is posted to your inventory dashboard, where you can browse artifacts across repos and branches, track drift over time, and share an executive view with compliance stakeholders:
+
+```yaml
+      - uses: Lab700xOrg/aisbom@v1
+        with:
+          directory: models/
+          token: ${{ secrets.AISBOM_TOKEN }}
+```
+
+Get a per-repo token at <https://app.aisbom.io/connect> (sign in with GitHub). Leave `token` unset and the Action stays purely local — nothing is sent to the dashboard.
+
+#### Data flow & privacy
+
+When (and only when) `token` is set, the Action POSTs the generated CycloneDX SBOM JSON to `https://app.aisbom.io/v1/scan-result`, along with the branch/tag name (`GITHUB_REF_NAME`) so the dashboard can attribute results to the right ref. That's the entire payload: the SBOM describes the *structure and findings* of your model files (names, hashes, licenses, risk levels) — never the weights or file contents, which don't leave the GitHub runner. Data is stored in the EU (Cloudflare R2/D1, EU jurisdiction). Every upload is announced in a loud log group in your CI output, so your logs always show when a network call happened and where the data went. To stop uploading, remove the `token` input — there is no background or implicit sending.
+
 See [`action/README_ACTION.md`](action/README_ACTION.md) for the full inputs/outputs reference, permissions block, and troubleshooting.
 
 ---
@@ -350,3 +392,4 @@ As of **0.9.1**, telemetry is **on by default**. `AISBOM_NO_TELEMETRY=1` is the
 ---
 
 *Built with ❤️ in Austin.*
+

aisbom_cli-1.1.0/PKG-INFO → aisbom_cli-1.2.0/README.md

@@ -1,28 +1,3 @@
-Metadata-Version: 2.4
-Name: aisbom-cli
-Version: 1.1.0
-Summary: An AI Supply Chain security tool that that detects Pickle bombs and generates CycloneDX SBOMs for Machine Learning models.
-License-File: LICENSE
-Author: Ajoy L
-Author-email: lab700xdev@gmail.com
-Requires-Python: >=3.11,<4.0
-Classifier: Programming Language :: Python :: 3
-Classifier: Programming Language :: Python :: 3.11
-Classifier: Programming Language :: Python :: 3.12
-Classifier: Programming Language :: Python :: 3.13
-Classifier: Programming Language :: Python :: 3.14
-Requires-Dist: click (<8.4.0)
-Requires-Dist: cyclonedx-python-lib (>=8.5,<12.0)
-Requires-Dist: packaging (>=24,<27)
-Requires-Dist: pip-requirements-parser (>=32.0.1,<33.0.0)
-Requires-Dist: requests (>=2.32.3,<3.0.0)
-Requires-Dist: rich (>=13.7.1,<15.0.0)
-Requires-Dist: spdx-tools (>=0.8.3,<0.9.0)
-Requires-Dist: typer[all] (>=0.12.5,<0.26.0)
-Project-URL: Homepage, https://www.aisbom.io/
-Project-URL: Repository, https://github.com/Lab700xOrg/aisbom
-Description-Content-Type: text/markdown
-
 # AIsbom: The Supply Chain for Artificial Intelligence
 
 [![PyPI version](https://img.shields.io/pypi/v/aisbom-cli.svg)](https://pypi.org/project/aisbom-cli/)
@@ -261,6 +236,23 @@ When the scan is clean, the comment collapses to a one-line ✅:
 
 Re-runs update the same comment in place via a hidden `<!-- aisbom-action -->` marker — you'll never see stacked AIsbom comments on the same PR.
 
+### Hosted dashboard (optional)
+
+The PR comment shows you each scan; the hosted dashboard at [app.aisbom.io](https://app.aisbom.io) keeps the history. Set the optional `token` input and every scan's SBOM is posted to your inventory dashboard, where you can browse artifacts across repos and branches, track drift over time, and share an executive view with compliance stakeholders:
+
+```yaml
+      - uses: Lab700xOrg/aisbom@v1
+        with:
+          directory: models/
+          token: ${{ secrets.AISBOM_TOKEN }}
+```
+
+Get a per-repo token at <https://app.aisbom.io/connect> (sign in with GitHub). Leave `token` unset and the Action stays purely local — nothing is sent to the dashboard.
+
+#### Data flow & privacy
+
+When (and only when) `token` is set, the Action POSTs the generated CycloneDX SBOM JSON to `https://app.aisbom.io/v1/scan-result`, along with the branch/tag name (`GITHUB_REF_NAME`) so the dashboard can attribute results to the right ref. That's the entire payload: the SBOM describes the *structure and findings* of your model files (names, hashes, licenses, risk levels) — never the weights or file contents, which don't leave the GitHub runner. Data is stored in the EU (Cloudflare R2/D1, EU jurisdiction). Every upload is announced in a loud log group in your CI output, so your logs always show when a network call happened and where the data went. To stop uploading, remove the `token` input — there is no background or implicit sending.
+
 See [`action/README_ACTION.md`](action/README_ACTION.md) for the full inputs/outputs reference, permissions block, and troubleshooting.
 
 ---
@@ -375,4 +367,3 @@ As of **0.9.1**, telemetry is **on by default**. `AISBOM_NO_TELEMETRY=1` is the
 ---
 
 *Built with ❤️ in Austin.*
-

{aisbom_cli-1.1.0 → aisbom_cli-1.2.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [tool.poetry]
 name = "aisbom-cli"
-version = "1.1.0"
+version = "1.2.0"
 description = "An AI Supply Chain security tool that that detects Pickle bombs and generates CycloneDX SBOMs for Machine Learning models."
 authors = ["Ajoy L <lab700xdev@gmail.com>"]
 readme = "README.md"
@@ -9,11 +9,11 @@ repository = "https://github.com/Lab700xOrg/aisbom"
 urls = { "Homepage" = "https://www.aisbom.io/" }
 [tool.poetry.dependencies]
 python = "^3.11"
-typer = {extras = ["all"], version = ">=0.12.5,<0.26.0"}
-rich = ">=13.7.1,<15.0.0"
+typer = {extras = ["all"], version = ">=0.12.5,<0.27.0"}
+rich = ">=13.7.1,<16.0.0"
 cyclonedx-python-lib = ">=8.5,<12.0"
 pip-requirements-parser = "^32.0.1"
-click = "<8.4.0"
+click = "<8.5.0"
 spdx-tools = "^0.8.3"
 packaging = ">=24,<27"