tegwick
ad0ba6f2ba
Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a028f0-a42f-7582-89a8-ebaad7343834
46 lines
1.6 KiB
Markdown
46 lines
1.6 KiB
Markdown
# RMGR-WP-0008 SBOM authority handoff — 2026-08-22
|
|
|
|
Repo Manager no longer contains or claims an SBOM scanner implementation.
|
|
`src/repo_manager/sbom.py` and its parser-specific tests were removed after the
|
|
production State Hub façade moved read/write authority to SBOM Nexus.
|
|
|
|
Existing operator commands remain usable as deprecated compatibility aliases:
|
|
|
|
```text
|
|
rmgr sbom scan --path <checkout> --slug <slug>
|
|
rmgr sbom licence-report --path <checkout> --slug <slug>
|
|
```
|
|
|
|
Both invoke the `sbom-nexus` executable directly with `shell=False`. The command
|
|
is discovered on `PATH` or supplied through `SBOM_NEXUS_CLI`. Scan JSON now uses
|
|
`sbom-nexus.snapshot.v1` and adds:
|
|
|
|
```json
|
|
{
|
|
"delegated_by": "repo-manager",
|
|
"product_owner": "sbom-nexus"
|
|
}
|
|
```
|
|
|
|
The `licence-report` alias derives only the legacy report-shaped view from the
|
|
Nexus snapshot response; it contains no parser or licence-evaluation logic.
|
|
Output refusal/`--force` behavior remains in Repo Manager for CLI compatibility.
|
|
|
|
Verification:
|
|
|
|
- `uv run ruff check src tests`: passed;
|
|
- complete Repo Manager suite: 87 passed;
|
|
- end-to-end alias using the real Nexus CLI: `ok=true`, Nexus schema,
|
|
`product_owner=sbom-nexus`, 39 entries, Git revision present, zero errors;
|
|
- source search found no remaining `repo_manager.sbom`,
|
|
`repo-manager.sbom-snapshot.v1`, `scan_repository`, or `detect_sources`
|
|
implementation reference outside the new delegation adapter/test names.
|
|
|
|
The direct command is now documented first:
|
|
|
|
```text
|
|
sbom-nexus scan . --output sbom-snapshot.json
|
|
```
|
|
|
|
This preserves operator continuity without leaving competing permanent product
|
|
authority in Repo Manager.
|