coulomb/sbom-nexus
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat: add repository projection synchronization
All checks were successful
Build and Publish Container Image / build-and-push (push) Successful in 1m9s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a028f0-a42f-7582-89a8-ebaad7343834
This commit is contained in:
tegwick 2026-08-22 16:52:47 +02:00
parent d3258a6ba0
commit 280da08455
7 changed files with 317 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

14
workplans/SBOM-WP-0002-production-cutover.md
View file

@ -38,7 +38,7 @@ id: SBOM-WP-0002-T01
status: progress
priority: high
needs_human: true
intervention_note: "Warden requires operator OIDC/MFA for first rapp-sbom-nexus Forgejo repository creation and one-time secret provisioning for platform-pg-2/OpenBao."
intervention_note: "Warden requires an attended founder act for the first platform-pg-2 OpenBao database connection, SBOM Nexus dynamic roles/policies, and renewable External Secrets parent token. The database owner must also repair the governed backup credential/policy after a live S3 HeadBucket 403."
state_hub_task_id: "95a520d4-30c2-5c87-8054-6bfe549c2686"
```
@ -47,12 +47,15 @@ deploy the API without callers, and capture health plus backup/restore evidence.
Image publication, package rendering, family validation, and server-side dry-run
are complete; see
`docs/evidence/SBOM-WP-0002-T01-dark-deployment-preflight-2026-08-22.md`.
The overflow cell is now 1/1 Ready, but continuous archiving and its first base
backup fail closed on an S3 `HeadBucket` 403. Database-owner work is tracked by
`RAPP-POSTGRES-WP-0005`; no caller or Nexus runtime has been enabled.
## Synchronize repository projections
```task
id: SBOM-WP-0002-T02
status: todo
status: progress
priority: high
state_hub_task_id: "22cbb75f-d82f-5b47-9fef-27bde3b410d5"
```
@ -60,6 +63,13 @@ state_hub_task_id: "22cbb75f-d82f-5b47-9fef-27bde3b410d5"
Populate active repository identity and host checkout paths from Repo Manager.
Verify fleet totals and catch-up ordering without performing ingest.
The projection-only synchronizer and reconciliation contract are implemented.
Its dry-run never contacts the Nexus target and no code path calls an SBOM
ingest route. Production apply and catch-up ordering proof wait for the dark
runtime from T01. The isolated rehearsal reconciled all 120 source projections
and selected exactly the oldest three of 116 active repositories; see
`docs/evidence/SBOM-WP-0002-T02-repository-projection-rehearsal-2026-08-22.md`.
## Import and reconcile State Hub history
```task