coulomb/repo-manager
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

refactor: delegate SBOM scans to Nexus

Browse source 
Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a028f0-a42f-7582-89a8-ebaad7343834
This commit is contained in:
tegwick 2026-08-22 20:22:45 +02:00
parent 6d57d1c1b2
commit ad0ba6f2ba
8 changed files with 277 additions and 428 deletions
Download patch file Download diff file Expand all files Collapse all files

46
docs/evidence/RMGR-WP-0008-sbom-authority-handoff-2026-08-22.md Normal file
View file

@ -0,0 +1,46 @@
# RMGR-WP-0008 SBOM authority handoff — 2026-08-22
Repo Manager no longer contains or claims an SBOM scanner implementation.
`src/repo_manager/sbom.py` and its parser-specific tests were removed after the
production State Hub façade moved read/write authority to SBOM Nexus.
Existing operator commands remain usable as deprecated compatibility aliases:
```text
rmgr sbom scan --path <checkout> --slug <slug>
rmgr sbom licence-report --path <checkout> --slug <slug>
```
Both invoke the `sbom-nexus` executable directly with `shell=False`. The command
is discovered on `PATH` or supplied through `SBOM_NEXUS_CLI`. Scan JSON now uses
`sbom-nexus.snapshot.v1` and adds:
```json
{
"delegated_by": "repo-manager",
"product_owner": "sbom-nexus"
}
```
The `licence-report` alias derives only the legacy report-shaped view from the
Nexus snapshot response; it contains no parser or licence-evaluation logic.
Output refusal/`--force` behavior remains in Repo Manager for CLI compatibility.
Verification:
- `uv run ruff check src tests`: passed;
- complete Repo Manager suite: 87 passed;
- end-to-end alias using the real Nexus CLI: `ok=true`, Nexus schema,
`product_owner=sbom-nexus`, 39 entries, Git revision present, zero errors;
- source search found no remaining `repo_manager.sbom`,
`repo-manager.sbom-snapshot.v1`, `scan_repository`, or `detect_sources`
implementation reference outside the new delegation adapter/test names.
The direct command is now documented first:
```text
sbom-nexus scan . --output sbom-snapshot.json
```
This preserves operator continuity without leaving competing permanent product
authority in Repo Manager.

4
docs/evidence/RMGR-WP-0008-sbom-cutover-2026-08-21.md
View file

@ -1,5 +1,9 @@
# RMGR-WP-0008 SBOM receiving and cutover evidence — 2026-08-21
> Superseded ownership note (2026-08-22): this evidence records the interim
> Repo Manager scanner. SBOM Nexus is now the sole scanner/snapshot product
> owner; see `RMGR-WP-0008-sbom-authority-handoff-2026-08-22.md`.
Repo Manager now derives an SBOM snapshot from repository-owned lockfiles and
the reviewed `sbom-tools.yaml` escape hatch. The snapshot includes source path
and SHA-256 provenance, Git revision, canonical UTC generation time, ecosystem,

8
docs/repository-registers_v0.1.md
View file

@ -63,10 +63,18 @@ replaceable snapshot and licence/copyleft report without copying State Hub rows
back into a new source-of-truth file.
```bash
sbom-nexus scan . --output sbom-snapshot.json
# Deprecated compatibility aliases; both delegate to the sbom-nexus executable.
rmgr sbom scan --path . --output sbom-snapshot.json
rmgr sbom licence-report --path .
```
SBOM Nexus is the sole scanner and snapshot product owner. Repo Manager retains
these aliases only so existing repository workflows do not break; set
`SBOM_NEXUS_CLI` when `sbom-nexus` is not on `PATH`. Their JSON includes
`product_owner: sbom-nexus` and the Nexus `sbom-nexus.snapshot.v1` schema.
Detection covers `uv.lock`, `requirements.txt`, `package-lock.json`,
`yarn.lock`, `Cargo.lock`, `go.sum`, `.terraform.lock.hcl`, Ansible requirements
under `ansible/`, and root `sbom-tools.yaml`. Each source carries a SHA-256 and