What the export does and does not establish
GitHub documents several repository backup approaches, including Git-based copies and selected metadata through migration archives. Their coverage differs. A source checkout is not a complete record of issues, pull requests, discussions, releases, or large-file assets. Select the collection method by the specific artifact needed and verify what the resulting package actually contains.
Content boundaries to review
Repository control does not establish rights over every contribution. Review employee assignments, contractor terms, inbound contributions, vendored dependencies, generated files, and third-party test fixtures. Public visibility is not a substitute for a license. A repository without a clear licensing basis should remain outside a commercial dataset until a qualified review resolves the intended use.
Prepare a narrow candidate collection
Choose whether the product is code, review dialogue, bug-to-fix pairs, or execution traces. Link examples to exact commits rather than mutable branch names. Exclude secrets from both current files and history. Keep tests and environment information when they are needed to reproduce a claim, while avoiding credentials, private package access, or production data.
Evidence to preserve
Preserve commit hashes, repository identity, license files at the relevant revision, notices, contribution records, and the method used to collect metadata. Maintain file-level exceptions for embedded third-party code. Record transformations such as formatting, deduplication, or removal of personal emails. Keep validation results tied to the precise revision that was tested.
Validate before offering a sample
Assess a sample for accidental benchmark contamination and duplicated upstream projects before estimating unique volume. A bug-fix pair should show the failing condition and the verified correction, not just an attractive commit message. Present unresolved license questions as exclusions or review tasks rather than claiming that a hosting platform has authorized downstream model training.
Before any external sample or sale, have the responsible rights and privacy reviewers assess the proposed recipient, training or evaluation purpose, retention, redistribution, and deletion obligations. Preserve the relevant contract versions and written decisions. These preparation steps are a review framework, not a legal conclusion or a statement that the platform endorses commercialization.