feat: project Nexus SBOM state into summaries

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a028f0-a42f-7582-89a8-ebaad7343834

tests/test_sbom_nexus_compat.py

@@ -220,3 +220,61 @@ async def test_nexus_failure_is_visible_and_does_not_fall_back(client, monkeypat
 
     assert response.status_code == 502
     assert response.json()["detail"] == "SBOM Nexus is unavailable: ConnectError"
+
+
+async def test_repo_reads_project_nexus_last_attempt_at(client, monkeypatch):
+    await _create_repo(client)
+
+    async def repositories(path: str, **kwargs):
+        assert path == "/repositories/"
+        return [
+            {
+                "slug": "testrepo",
+                "last_attempt_at": "2026-08-22T14:00:00Z",
+            }
+        ]
+
+    monkeypatch.setattr(settings, "sbom_nexus_read_mode", "nexus")
+    monkeypatch.setattr("api.routers.repos.get_sbom_nexus_json", repositories)
+
+    collection = await client.get("/repos/")
+    detail = await client.get("/repos/testrepo")
+
+    assert collection.status_code == 200
+    assert detail.status_code == 200
+    assert collection.json()[0]["last_sbom_at"] == "2026-08-22T14:00:00Z"
+    assert collection.json()[0]["sbom_source"] == "sbom-nexus"
+    assert detail.json()["last_sbom_at"] == "2026-08-22T14:00:00Z"
+    assert detail.json()["sbom_source"] == "sbom-nexus"
+
+
+async def test_state_summaries_use_nexus_metrics(client, monkeypatch):
+    async def sbom_metrics(path: str, **kwargs):
+        if path == "/sbom/snapshots/":
+            return [
+                {
+                    "snapshot_at": "2026-08-22T12:00:00Z",
+                    "entry_count": 3,
+                },
+                {
+                    "snapshot_at": "2026-08-22T14:00:00Z",
+                    "entry_count": 5,
+                },
+            ]
+        if path == "/sbom/report/licences/":
+            return {"groups": [], "copyleft_direct_count": 7}
+        raise AssertionError(f"unexpected Nexus path {path}")
+
+    monkeypatch.setattr(settings, "sbom_nexus_read_mode", "nexus")
+    monkeypatch.setattr("api.routers.state.get_sbom_nexus_json", sbom_metrics)
+    monkeypatch.setattr("api.services.summary_cache.get_sbom_nexus_json", sbom_metrics)
+
+    summary = await client.get("/state/summary", params={"refresh": "true"})
+    overview = await client.get("/state/overview", params={"refresh": "true"})
+
+    assert summary.status_code == 200
+    assert overview.status_code == 200
+    assert summary.json()["licence_risk_count"] == 7
+    assert overview.json()["licence_risk_count"] == 7
+    assert overview.json()["sbom_snapshot_count"] == 2
+    assert overview.json()["sbom_package_total"] == 8