feat: route SBOM writes to Nexus behind flag

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a028f0-a42f-7582-89a8-ebaad7343834

api/routers/sbom.py

@@ -20,7 +20,13 @@ from api.schemas.sbom import (
     SBOMSnapshotRead,
 )
 from api.services.legacy_meter import identity_from_request, record_legacy_usage
-from api.services.sbom_nexus import SBOMNexusError, get_json, reads_from_nexus
+from api.services.sbom_nexus import (
+    SBOMNexusError,
+    get_json,
+    post_json,
+    reads_from_nexus,
+    writes_to_nexus,
+)
 
 router = APIRouter(prefix="/sbom", tags=["sbom"])
 logger = logging.getLogger(__name__)
@@ -63,6 +69,29 @@ async def ingest_sbom(
 ) -> dict:
     """Create a new SBOM snapshot for a repo. Previous snapshots are retained."""
     repo = await _get_repo_by_slug(body.repo_slug, session)
+    if writes_to_nexus():
+        payload = await _nexus_post("/sbom/ingest/", body=body.model_dump(mode="json"))
+        try:
+            snapshot_at = datetime.fromisoformat(
+                payload["snapshot_at"].replace("Z", "+00:00")
+            )
+            result = {
+                "repo_slug": payload["repo_slug"],
+                "snapshot_id": payload["snapshot_id"],
+                "ingested": payload["ingested"],
+                "snapshot_at": payload["snapshot_at"],
+            }
+        except (AttributeError, KeyError, TypeError, ValueError) as exc:
+            raise HTTPException(
+                status_code=502,
+                detail="SBOM Nexus returned an invalid ingest response",
+            ) from exc
+        repo.last_sbom_at = snapshot_at
+        repo.sbom_source = "sbom-nexus"
+        await session.commit()
+        await _meter_compat(session, request, "POST", "/sbom/ingest/")
+        return result
+
     now = datetime.now(tz=timezone.utc)
 
     snap = SBOMSnapshot(
@@ -315,6 +344,13 @@ async def _nexus_get(path: str, *, params: dict | None = None):
         raise HTTPException(status_code=exc.status_code, detail=exc.detail) from exc
 
 
+async def _nexus_post(path: str, *, body: dict):
+    try:
+        return await post_json(path, body=body)
+    except SBOMNexusError as exc:
+        raise HTTPException(status_code=exc.status_code, detail=exc.detail) from exc
+
+
 async def _local_repo_ids(items: list[dict], session: AsyncSession) -> dict[str, uuid.UUID]:
     slugs = {item.get("repo_slug") for item in items}
     if None in slugs: