coulomb/repo-manager
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

refactor: delegate SBOM scans to Nexus

Browse source 
Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a028f0-a42f-7582-89a8-ebaad7343834
This commit is contained in:
tegwick 2026-08-22 20:22:45 +02:00
parent 6d57d1c1b2
commit ad0ba6f2ba
8 changed files with 277 additions and 428 deletions
Download patch file Download diff file Expand all files Collapse all files

8
docs/repository-registers_v0.1.md
View file

@ -63,10 +63,18 @@ replaceable snapshot and licence/copyleft report without copying State Hub rows
back into a new source-of-truth file.
```bash
sbom-nexus scan . --output sbom-snapshot.json
# Deprecated compatibility aliases; both delegate to the sbom-nexus executable.
rmgr sbom scan --path . --output sbom-snapshot.json
rmgr sbom licence-report --path .
```
SBOM Nexus is the sole scanner and snapshot product owner. Repo Manager retains
these aliases only so existing repository workflows do not break; set
`SBOM_NEXUS_CLI` when `sbom-nexus` is not on `PATH`. Their JSON includes
`product_owner: sbom-nexus` and the Nexus `sbom-nexus.snapshot.v1` schema.
Detection covers `uv.lock`, `requirements.txt`, `package-lock.json`,
`yarn.lock`, `Cargo.lock`, `go.sum`, `.terraform.lock.hcl`, Ansible requirements
under `ansible/`, and root `sbom-tools.yaml`. Each source carries a SHA-256 and