[emmanuelgjr]

Summary

Items 16–17 of the data-validation review.

One shared core for the dataset validators (17)

datasets/_shared/validate_lib.py replaces five near-identical copies. The copies had already drifted: format checking was missing from three of them until #93. The shared core does:

• schema validation with format (dates, URIs) enforced;
• DSGAI IDs checked against the taxonomy at any depth (dsgai_mapping, dsgai_id, addresses_dsgai), which covers the risk-assessment nesting;
• the entry ID must match its file name, and no two entries may share an ID;
• the same output format and exit codes as before (0 ok, 1 fail, 2 jsonschema missing).

Each validate.py (exploit, vulnerability, riskassessment, rag, incident) now only states its schema, ID field and dataset-specific rules. Those rules are unchanged: exploit's "an ATLAS exploit_id must be in mitre_atlas_mapping" and vulnerability's "a CVE vulnerability_id must equal cve_id". Tests run the real validators on broken copies to prove both still fire.

The ID-matches-file-name and duplicate-ID checks are new for exploit, vulnerability and riskassessment; all current entries pass. The agentdataflow validator (different structure, contributor-designed) and the Turkish pairs validator (contributor-owned) keep their own code. Validators still need only jsonschema.

Findings on the PR diff (16)

run_all_checks.py --github (used in CI) prints a GitHub Actions annotation for every shared-check finding and every dataset-validator failure, on the exact line: validators/json_lines.py maps each finding's JSON pointer to its line. Unlike SARIF upload, workflow annotations also work on PRs from forks, which is how most contributions arrive.

Smoke test on a copy with two planted errors (an unknown DSGAI ID and an invalid rating): five annotations, on lines 8 (dsgai_mapping) and 11 (qualitative), from both the dataset validator and the shared checks.

Verification

• 194 tests pass: the shared core rules, the dataset-specific rules on real validators, pointer-to-line mapping (including escaped quotes and brackets inside strings), and the annotation format.
• All validators produce the same "OK: N entries" results as before. actionlint is clean.

🤖 Generated with Claude Code