docs(website): publish CycloneDX AI-BOM export in Govern tutorial#1943
Merged
Conversation
SMI-3140's CycloneDX AI-BOM export (compliance_report, format: cyclonedx) merged and Done, but was never documented on skillsmith.app -- the compliance_report tool wasn't in the Govern tutorial or mcp-server reference at all, predating this feature (SOC2 format shipped under SMI-3906 with the same gap). - govern.astro: add compliance_report to the tools table, a new Step 8 walking through the CycloneDX export (backfillDependencies caveat, dependencyDataSource states, validator recommendation), and the 'newly launched, not yet validated at scale' caveat callout that matches the CHANGELOG and the BOM's own skillsmith:notice property - dependencies.astro: remove the stale 'No CycloneDX AI-BOM export' Limitations bullet and link to the new tutorial step - mcp-server.astro: add compliance_report to the Govern tutorial's tool-list line - pricing.astro: move 'Compliance reports' out of the Enterprise 'On the roadmap' list into the actual comparison table (Team+Enterprise) -- it has been a shipped, gated feature since SMI-3906 Content only; merge is held until the 2026-07-19 npm publish cadence lands the feature on @skillsmith/mcp-server, so the tutorial doesn't describe behavior not yet available to anyone following it. Refs SMI-3140 Refs SMI-5688 Co-Authored-By: claude-flow <ruv@ruv.net> Co-Authored-By: Claude <noreply@anthropic.com>
Website Preview
|
wrsmith108
marked this pull request as ready for review
July 20, 2026 18:30
E2E Test ResultsE2E Test Results - July 20, 2026Summary
Test Results
Generated by skillsmith E2E test suite |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Business Summary
What shipped: The CycloneDX AI-BOM export (
compliance_report,format: "cyclonedx", SMI-3140) is now documented on skillsmith.app — it shipped in code weeks ago but was never published anywhere on the site. Added a new Govern tutorial step showing how to generate and validate the export, addedcompliance_reportto the MCP tool reference, removed a now-false "not exportable" line from the dependency-intelligence page, and corrected the pricing page, which still listed "Compliance reports" as an unshipped Enterprise roadmap item even though it's been live (Team+Enterprise) since SMI-3906.Quality bar:
astro checkclean (0 errors/warnings/hints across all 169 site files). Full productionastro buildverified against unmodified content onmain's own container as a control; this worktree's container hit an unrelated environment bug during build/test (see below), independently root-caused and filed, not something these four content files caused.Found along the way: two issues filed separately, not fixed in this PR — SMI-5735 (pricing.astro's Audit Logging/SIEM export/SSO/RBAC roadmap section also looks stale against what's actually shipped, needs its own per-feature verification pass) and SMI-5736 (a worktree-infra bug: fresh worktree containers bind-mount
main's own livenode_modules/.vitecache instead of a worktree-scoped one, breakingastro build/vitestfor any branch pushed from a fresh worktree, regardless of what it touches — confirmed via a control build onmain's container, and vianpm run preflightfailing identically on untouched packages likecore/enterprise). Pushed this branch via the documentedSKILLSMITH_PRE_PUSH_HOST=1escape hatch as a result — full host-side test suite passed clean across every package.Net result: Content complete and verified. Do not merge yet — held until the 2026-07-19 03:00 UTC npm publish confirms
@skillsmith/mcp-serverhas the CycloneDX export live. Merging before then would put a tutorial describingbackfillDependencies: trueand the newdependencyDataSourcestates in front of Team/Enterprise customers whose installed package doesn't support them yet. Opened as a draft PR for exactly that reason.Technical detail
packages/website/src/pages/docs/tutorials/govern.astro—compliance_reportrow in the tools table, new Step 8 (CycloneDX export walkthrough: format,backfillDependencies+better-sqlite3-only caveat,dependencyDataSourcestates, validator recommendation), "newly launched, not yet validated at scale" callout matching the CHANGELOG/BOMskillsmith:noticeproperty, a#cyclonedx-exportanchor id (this site has no heading auto-slug plugin — matches the existingmaintain.astroprecedent for manual anchor ids).packages/website/src/pages/docs/dependencies.astro— removed the stale "No CycloneDX AI-BOM export" Limitations bullet; added a link to the new Govern step.packages/website/src/pages/docs/mcp-server.astro— addedcompliance_report(Team+) to the Govern tutorial's tool-list line (~509).packages/website/src/pages/pricing.astro— added a "Compliance Reports (SOC 2 / CycloneDX AI-BOM)" row to the real comparison table (Team ✓ / Enterprise ✓); removed the duplicate "Compliance reports" bullet from the Enterprise roadmap list.e9a952f1.