coulomb/repo-manager
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

refactor: delegate SBOM scans to Nexus

Browse source 
Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a028f0-a42f-7582-89a8-ebaad7343834
This commit is contained in:
tegwick 2026-08-22 20:22:45 +02:00
parent 6d57d1c1b2
commit ad0ba6f2ba
8 changed files with 277 additions and 428 deletions
Download patch file Download diff file Expand all files Collapse all files

4
docs/evidence/RMGR-WP-0008-sbom-cutover-2026-08-21.md
View file

@ -1,5 +1,9 @@
# RMGR-WP-0008 SBOM receiving and cutover evidence — 2026-08-21
> Superseded ownership note (2026-08-22): this evidence records the interim
> Repo Manager scanner. SBOM Nexus is now the sole scanner/snapshot product
> owner; see `RMGR-WP-0008-sbom-authority-handoff-2026-08-22.md`.
Repo Manager now derives an SBOM snapshot from repository-owned lockfiles and
the reviewed `sbom-tools.yaml` escape hatch. The snapshot includes source path
and SHA-256 provenance, Git revision, canonical UTC generation time, ecosystem,