[emmanuelgjr]

Summary

Items 12–13 of the data-validation review.

MLCommons Croissant 1.1 + Responsible AI metadata

• Each published dataset now has a croissant.json: vulnerability, exploit, riskassessment, agentdataflow, promptinj and rag. Incident (no entries yet) and crossframework (superseded) are skipped.
• data_validation/croissant/build_croissant.py generates them with the official mlcroissant library:
  • File checksums, record fields and dates come from the repository, so the output is deterministic and doesn't depend on git history.
  • The RAI text (dataLimitations, dataBiases, dataUseCases, personalSensitiveInformation, dataCollection/Type, dataSocialImpact, dataReleaseMaintenancePlan) is written per dataset in the generator, checked against the data's actual distributions. For example, the vulnerability dataset's skew toward agent frameworks and High/Critical severity, and the exploit dataset's ~70% ATLAS share.
  • Record sets over each index.csv or manifest let ML tooling load the records directly. NeurIPS 2026 requires Croissant with RAI fields for dataset submissions.
• New CI job croissant, using the new optional requirements-croissant.txt:
  • the files must be up to date with the data;
  • each must pass mlcroissant validate;
  • each record set must load exactly as many records as its CSV has rows (verified locally: 46, 59, 23, 3, 300, 149).

Versioned, checksummed, signed releases

• New datasets-release workflow, triggered by pushing a datasets-v<version> tag that matches CITATION.cff. It:
  • re-runs every check;
  • builds one zip per dataset (with the shared taxonomy, citation and licence) plus an all-datasets zip;
  • writes SHA256SUMS;
  • attests build provenance for every file with Sigstore (actions/attest-build-provenance, pinned), verifiable with gh attestation verify;
  • publishes the GitHub release.
• The archive and checksum steps were dry-run locally against this branch, and all checksums verify.

Citation and DOI

• CITATION.cff: datasets version 1.0.0, CC-BY-SA-4.0. This enables GitHub's "Cite this repository" button.
• .zenodo.json supplies Zenodo's metadata. One manual step remains: an org owner has to enable this repository in Zenodo's GitHub integration (zenodo.org → GitHub). After that, each datasets-v* release is archived on Zenodo with a DOI.

Docs

datasets/README.md gains a "Metadata, releases and citation" section. The contribution steps now say to regenerate index.csv and croissant.json after editing entries.

Verification

• 180 tests pass (new guards: every published dataset has Croissant metadata; the CITATION.cff version is semver).
• run_all_checks.py: 0 errors (croissant.json is excluded from the record checks). actionlint is clean.

🤖 Generated with Claude Code