coulomb/repo-manager
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(sbom): add authoritative Nexus client

Browse source 
Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a023c0-a0a3-7c03-b395-5a0d2757214d
This commit is contained in:
tegwick 2026-08-22 23:26:45 +02:00
parent 135b1647d7
commit b068e9da42
5 changed files with 446 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

24
workplans/RMGR-WP-0011-sbom-nexus-production-client.md
View file

@ -60,7 +60,7 @@ workstation filesystem must never be mounted into the cluster.
```task
id: RMGR-WP-0011-T02
status: todo
status: done
priority: high
state_hub_task_id: "280cfa84-1561-5cb9-8943-aa0775c57be6"
```
@ -70,6 +70,19 @@ projection, ingest, latest-snapshot, and licence-report surfaces needed by Repo
Manager. Preserve bounded timeouts and actionable failures; credentials, when
introduced through the platform path, must never enter files, output, or logs.
**Result (2026-08-22):** `SBOMNexusClient` provides the four pinned service
operations with explicit `SBOM_NEXUS_URL`, a configurable 0.1–300 second bound,
route-specific success validation, URL-safe slugs, and sanitized deterministic
timeout/transport/HTTP/JSON/contract errors. Optional runtime bearer
credentials are representation-hidden and never copied into failures.
Mutation calls are not retried implicitly. Ingest accepts a stable
`Idempotency-Key`, and failures state whether the operation may already have
committed. Callers may require an exact source revision; a mismatched ingested
receipt fails closed while preserving that commit-uncertainty signal. The
repository projection parameter is explicitly Nexus-local
`nexus_checkout_path`, subject to the controlled-source boundary in T01.
## Make local scanning an explicit preview
```task
@ -96,7 +109,7 @@ contract tests carry the same semantics.
```task
id: RMGR-WP-0011-T04
status: todo
status: progress
priority: medium
state_hub_task_id: "81fed060-3431-5d9b-819b-fcc7d629c364"
```
@ -106,6 +119,13 @@ prove by source inspection that Repo Manager has no scanner implementation,
snapshot store, freshness evaluation, catch-up policy, or licence classifier.
Capture the exact production handoff evidence required by SBOM-WP-0002.
**Progress (2026-08-22):** contract tests now cover additive preview schemas,
unknown schema rejection, all four authoritative routes, bounded configuration,
credential redaction, malformed success responses, timeouts, server failures,
commit uncertainty, idempotency headers, and revision mismatch. Remaining is
the production consumer handoff and final source/ownership inspection after the
controlled source-input topology is available.
## Acceptance
- Authoritative mode talks to SBOM Nexus and returns its pinned snapshot