feat: Add ModelReadmeFetcher and integrate README data into BOM generation

- Implemented ModelReadmeFetcher to fetch and parse model README files.
- Enhanced generator to fetch model README data and include it in the BOM.
- Updated field specifications to incorporate model card properties from README.
- Added tests for ModelReadmeFetcher and updated generator tests to validate README integration.
- Modified metadata handling to support additional model card fields such as use cases, limitations, and environmental considerations.
- Updated example model loading script to reflect changes in model identifiers.

Author: wiebe-vandendriessche

README.md

@@ -11,7 +11,8 @@ What works today:
 
 - Basic scanning for Hugging Face model IDs in Python-like sources via `from_pretrained("...")`.
 - AIBOM generation per detected model in JSON or XML.
-- Optional Hugging Face Hub API fetch to populate some metadata fields.
+- Hugging Face Hub API fetch to populate metadata fields.
+- Hugging Face Repo README fetch to populate more metadata fields.
 - Completeness scoring and validation of existing AIBOM files.
 
 What is explicitly future work:

internal/builder/bom_builder.go

@@ -29,6 +29,7 @@ func (b BOMBuilder) Build(ctx BuildContext) (*cdx.BOM, error) {
 		ModelID: strings.TrimSpace(ctx.ModelID),
 		Scan:    ctx.Scan,
 		HF:      ctx.HF,
+		Readme:  ctx.Readme,
 	}
 	tgt := metadata.Target{
 		BOM:                       bom,

internal/builder/context.go

@@ -9,6 +9,7 @@ type BuildContext struct {
 	ModelID string
 	Scan    scanner.Discovery
 	HF      *fetcher.ModelAPIResponse
+	Readme  *fetcher.ModelReadmeCard
 }
 
 type Options struct {

internal/completeness/completeness_test.go

@@ -67,6 +67,20 @@ func buildFullyPopulatedBOMForRegistry(t *testing.T) *cdx.BOM {
 			Evidence: "from_pretrained() pattern at line 1",
 		},
 		HF: hf,
+		Readme: &fetcher.ModelReadmeCard{
+			BaseModel:                  "bert-base-uncased",
+			ModelCardContact:           "[email protected]",
+			DirectUse:                  "Use for classification.",
+			OutOfScopeUse:              "Do not use for medical.",
+			BiasRisksLimitations:       "May be biased.",
+			BiasRecommendations:        "Use with care.",
+			EnvironmentalHardwareType:  "NVIDIA A100",
+			EnvironmentalHoursUsed:     "10",
+			EnvironmentalCloudProvider: "AWS",
+			EnvironmentalComputeRegion: "us-east-1",
+			EnvironmentalCarbonEmitted: "123g",
+			ModelIndexMetrics:          []fetcher.ModelIndexMetric{{Type: "accuracy", Value: "0.91"}},
+		},
 	}
 	tgt := metadata.Target{
 		BOM:                       bom,

internal/fetcher/model_api_fetcher.go

@@ -119,6 +119,6 @@ func (f *ModelAPIFetcher) Fetch(ctx context.Context, modelID string) (*ModelAPIR
 		logf(modelID, "decode error (%v)", err)
 		return nil, err
 	}
-	logf(modelID, "ok (library=%q pipeline=%q)", strings.TrimSpace(parsed.LibraryName), strings.TrimSpace(parsed.PipelineTag))
+	logf(modelID, "ok")
 	return &parsed, nil
 }