Skip to content

[DO NOT MERGE] Add Tutorials Audit Framework#3815

Draft
sekyondaMeta wants to merge 1 commit intomainfrom
hybrid-deprecation-scanner
Draft

[DO NOT MERGE] Add Tutorials Audit Framework#3815
sekyondaMeta wants to merge 1 commit intomainfrom
hybrid-deprecation-scanner

Conversation

@sekyondaMeta
Copy link
Copy Markdown
Contributor

Automated audit framework for PyTorch tutorial content health. Scheduled monthly via GitHub Actions (Stage 1: deterministic script-based audits) with optional Claude Code semantic analysis (Stage 2).

Audit passes:

  • Build log warnings: extract DeprecationWarning/FutureWarning from CI logs
  • Changelog diff: cross-reference PyTorch release notes against tutorials
  • Orphaned tutorials: detect invisible tutorials, broken cards, NOT_RUN accountability
  • Security patterns: torch.load without weights_only, eval(), non-HTTPS URLs
  • Staleness check: tutorials-review-data.json freshness analysis
  • Dependency health: import vs requirements.txt mismatches
  • Template compliance: author attribution, grid cards, conclusion sections
  • Index consistency: tag typos, missing thumbnails, redirect chains
  • Build health: metadata.json coverage, shard imbalance, NOT_RUN growth

Security:

  • Content sanitization (HTML comments, @mentions, script tags, truncation)
  • Claude skill with 6 mandatory guardrails (no PR actions, no file modifications)
  • Safe AST-based parsing of redirects.py (no exec())
  • Streaming zip download for build logs (no full memory load)
  • Action versions pinned to SHA hashes

Config-driven for cross-repo adoption. Only config.yml differs per repo. Trend tracking via previous closed audit issue (no contents:write needed). 68 pytest tests covering security boundary and all audit passes.

Automated audit framework for PyTorch tutorial content health.
Scheduled monthly via GitHub Actions (Stage 1: deterministic script-based
audits) with optional Claude Code semantic analysis (Stage 2).

Audit passes:
- Build log warnings: extract DeprecationWarning/FutureWarning from CI logs
- Changelog diff: cross-reference PyTorch release notes against tutorials
- Orphaned tutorials: detect invisible tutorials, broken cards, NOT_RUN accountability
- Security patterns: torch.load without weights_only, eval(), non-HTTPS URLs
- Staleness check: tutorials-review-data.json freshness analysis
- Dependency health: import vs requirements.txt mismatches
- Template compliance: author attribution, grid cards, conclusion sections
- Index consistency: tag typos, missing thumbnails, redirect chains
- Build health: metadata.json coverage, shard imbalance, NOT_RUN growth

Security:
- Content sanitization (HTML comments, @mentions, script tags, truncation)
- Claude skill with 6 mandatory guardrails (no PR actions, no file modifications)
- Safe AST-based parsing of redirects.py (no exec())
- Streaming zip download for build logs (no full memory load)
- Action versions pinned to SHA hashes

Config-driven for cross-repo adoption. Only config.yml differs per repo.
Trend tracking via previous closed audit issue (no contents:write needed).
68 pytest tests covering security boundary and all audit passes.
@pytorch-bot
Copy link
Copy Markdown

pytorch-bot bot commented Apr 2, 2026

🔗 Helpful Links

🧪 See artifacts and rendered test results at hud.pytorch.org/pr/pytorch/tutorials/3815

Note: Links to docs will display an error until the docs builds have been completed.

❌ 1 New Failure

As of commit bb0a3f8 with merge base ccac77f (image):

NEW FAILURE - The following job has failed:

This comment was automatically generated by Dr. CI and updates every 15 minutes.

@meta-cla meta-cla bot added the cla signed label Apr 2, 2026
@sekyondaMeta sekyondaMeta added skip-link-check Will allow you to skip linkcheck on a PR. Should only should be used when a link can't be fixed. build automation tutorials_audit used on tutorial audit PRs labels Apr 2, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

build automation cla signed skip-link-check Will allow you to skip linkcheck on a PR. Should only should be used when a link can't be fixed. tutorials_audit used on tutorial audit PRs

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant