coulomb/repo-manager
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(sbom): add authoritative Nexus client

Browse source 
Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a023c0-a0a3-7c03-b395-5a0d2757214d
This commit is contained in:
tegwick 2026-08-22 23:26:45 +02:00
parent 135b1647d7
commit b068e9da42
5 changed files with 446 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

38
docs/sbom-nexus-client-contract_v1.md
View file

@ -58,6 +58,44 @@ Calls use a bounded timeout and surface deterministic transport, HTTP, and
contract errors. Credentials enter only through the platform runtime path and
must never appear in files, command output, or logs.
## Authoritative client usage
The Python client requires `SBOM_NEXUS_URL`. `SBOM_NEXUS_TIMEOUT_SECONDS`
defaults to 30 seconds and is bounded to 0.1–300 seconds. An optional
`SBOM_NEXUS_TOKEN` may be injected at runtime; its value is excluded from
configuration representations and all structured errors.
```python
from repo_manager.sbom_client import SBOMNexusClient, SBOMNexusConfig
client = SBOMNexusClient(SBOMNexusConfig.from_environment())
client.upsert_repository(
"example",
nexus_checkout_path="/srv/controlled/example/abc123",
active=True,
)
receipt = client.ingest_repository(
"example",
expected_source_revision="abc123",
operation_id="stable-operation-id",
)
latest = client.latest_snapshot("example")
report = client.licence_report()
```
The client URL-escapes repository slugs, accepts only object responses with the
pinned route-specific fields, and adds an `authoritative-service` context. It
does not retry mutations automatically: a timeout or server failure can occur
after Nexus commits. Structured errors therefore expose
`mutation_may_have_committed`; callers must resolve the stable operation id or
read the resulting snapshot before deciding whether to retry.
When an expected source revision is supplied, an `ingested` receipt for any
other revision fails closed as `source_revision_mismatch` and explicitly notes
that the mutation may already have committed. The checkout path sent to Nexus
is Nexus-local controlled-source identity, never authorization to mount a
workstation path into the cluster.
## Repository source identity and provenance
Repo Manager remains authoritative for repository slug, active state,