coulomb/sbom-nexus
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
A sbom management service
16 commits 1 branch 0 tags 378 KiB
Find a file
tegwick 280da08455
All checks were successful
Build and Publish Container Image / build-and-push (push) Successful in 1m9s
Details
feat: add repository projection synchronization 
Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a028f0-a42f-7582-89a8-ebaad7343834
2026-08-22 16:52:47 +02:00
.claude/rules feat: establish sbom nexus extraction slice 2026-08-22 12:50:08 +02:00
.forgejo/workflows feat: package dark deployment runtime 2026-08-22 13:59:24 +02:00
docs feat: add repository projection synchronization 2026-08-22 16:52:47 +02:00
migrations feat: package dark deployment runtime 2026-08-22 13:59:24 +02:00
registry feat: establish sbom nexus extraction slice 2026-08-22 12:50:08 +02:00
scripts feat: add repository projection synchronization 2026-08-22 16:52:47 +02:00
src/sbom_nexus feat: add repository projection synchronization 2026-08-22 16:52:47 +02:00
tests feat: add repository projection synchronization 2026-08-22 16:52:47 +02:00
workplans feat: add repository projection synchronization 2026-08-22 16:52:47 +02:00
.custodian-brief.md chore(consistency): sync task status from DB [auto] 2026-08-22 15:05:51 +02:00
.dockerignore feat: establish sbom nexus extraction slice 2026-08-22 12:50:08 +02:00
.gitignore feat: establish sbom nexus extraction slice 2026-08-22 12:50:08 +02:00
.repo-classification.yaml feat: establish sbom nexus extraction slice 2026-08-22 12:50:08 +02:00
AGENTS.md feat: prepare postgres sbom cutover 2026-08-22 13:14:24 +02:00
alembic.ini feat: prepare postgres sbom cutover 2026-08-22 13:14:24 +02:00
CLAUDE.md feat: establish sbom nexus extraction slice 2026-08-22 12:50:08 +02:00
Containerfile feat: package dark deployment runtime 2026-08-22 13:59:24 +02:00
INTENT.md feat: establish sbom nexus extraction slice 2026-08-22 12:50:08 +02:00
LICENSE feat: establish sbom nexus extraction slice 2026-08-22 12:50:08 +02:00
Makefile feat: prepare postgres sbom cutover 2026-08-22 13:14:24 +02:00
ProductRequirementsDocument.md feat: prepare postgres sbom cutover 2026-08-22 13:14:24 +02:00
pyproject.toml feat: prepare postgres sbom cutover 2026-08-22 13:14:24 +02:00
README.md feat: package dark deployment runtime 2026-08-22 13:59:24 +02:00
SCOPE.md feat: prepare postgres sbom cutover 2026-08-22 13:14:24 +02:00
uv.lock feat: prepare postgres sbom cutover 2026-08-22 13:14:24 +02:00
WORK-RECORDS.md chore: refresh dark deployment task index 2026-08-22 15:06:15 +02:00

README.md

sbom-nexus

SBOM Nexus is the dedicated software-bill-of-materials service for the Coulomb fleet. It captures dependency evidence from repositories, keeps immutable snapshots, evaluates licence risk and freshness, and provides a bounded catch-up queue for automation.

The product direction is defined in INTENT.md. The first delivery contract is in ProductRequirementsDocument.md.

Development

uv sync --dev
uv run pytest
uv run ruff check src tests
uv run sbom-nexus serve --reload

The default API listens on http://127.0.0.1:8010. Local development uses SQLite through SBOM_NEXUS_DATABASE_PATH; production uses SBOM_NEXUS_DATABASE_URL_FILE=/var/run/secrets/.../url and make migrate. The direct SBOM_NEXUS_DATABASE_URL variable remains available for disposable development environments; mounted secret files are preferred for production.

Initial API surface

  • GET /state/health
  • PUT /repositories/{repo_slug}
  • GET /sbom/catch-up?limit=3
  • POST /sbom/{repo_slug}/ingest
  • State Hub-compatible /sbom/ snapshot, entry, repository, and licence routes

See docs/state-hub-sbom-extraction-review.md for the extraction inventory and cutover dispositions.