edited ci file

internal/api/handlers/sbom.go

@@ -110,7 +110,7 @@ func (h *SBOMHandler) GetLatestDocument(w http.ResponseWriter, r *http.Request)
 }
 
 // Generate triggers on-demand SBOM generation for a repo at a given ref/SHA.
-// POST /api/v1/repos/{owner}/{repo}/sbom/generate?ref=<sha-or-branch>
+// POST /api/v1/repos/{owner}/{repo}/sbom/generate?ref=<sha-or-branch>[&runID=<id>]
 func (h *SBOMHandler) Generate(w http.ResponseWriter, r *http.Request) {
 	repoID, ok := resolveRepoID(h.db, w, r)
 	if !ok {
@@ -126,7 +126,12 @@ func (h *SBOMHandler) Generate(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	report, err := h.generator.GenerateOnDemand(repoID, sha)
+	var runID int64
+	if rid := r.URL.Query().Get("runID"); rid != "" {
+		runID, _ = strconv.ParseInt(rid, 10, 64)
+	}
+
+	report, err := h.generator.GenerateOnDemand(repoID, runID, sha)
 	if err != nil {
 		jsonError(w, "generation failed: "+err.Error(), http.StatusInternalServerError)
 		return

internal/api/handlers/scanning.go

@@ -7,6 +7,7 @@ import (
 	"github.com/go-chi/chi/v5"
 	"xorm.io/xorm"
 
+	"github.com/forgeo/forgebucket/internal/api/middleware"
 	"github.com/forgeo/forgebucket/internal/domain/scanning"
 	"github.com/forgeo/forgebucket/internal/models"
 )
@@ -52,7 +53,7 @@ func (h *ScanningHandler) DismissSecrets(w http.ResponseWriter, r *http.Request)
 	}
 
 	// Get current user from session for audit trail.
-	username := r.Context().Value("user").(string)
+	username, _ := r.Context().Value(middleware.ContextKeyUsername).(string)
 
 	if err := h.scanner.DismissFindings(leakID, username); err != nil {
 		jsonError(w, err.Error(), http.StatusNotFound)

internal/api/handlers/vulnscan.go

@@ -7,6 +7,7 @@ import (
 	"github.com/go-chi/chi/v5"
 	"xorm.io/xorm"
 
+	"github.com/forgeo/forgebucket/internal/api/middleware"
 	"github.com/forgeo/forgebucket/internal/domain/vulnscan"
 	"github.com/forgeo/forgebucket/internal/models"
 )
@@ -49,6 +50,9 @@ func (h *VulnScanHandler) Scan(w http.ResponseWriter, r *http.Request) {
 		jsonError(w, "scan failed: "+err.Error(), http.StatusInternalServerError)
 		return
 	}
+	if findings == nil {
+		findings = []models.VulnerabilityFinding{}
+	}
 	w.WriteHeader(http.StatusCreated)
 	jsonOK(w, findings)
 }
@@ -68,7 +72,7 @@ func (h *VulnScanHandler) Dismiss(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	username := r.Context().Value("user").(string)
+	username, _ := r.Context().Value(middleware.ContextKeyUsername).(string)
 
 	if err := h.scanner.DismissFindings(findingID, username); err != nil {
 		jsonError(w, err.Error(), http.StatusNotFound)

internal/api/router.go

@@ -206,13 +206,13 @@ func New(cfg *config.Config, engine *xorm.Engine, store sessions.Store, bus even
 							})
 							r.Get("/artifacts", artifactH.List)
 							r.With(csrf).Post("/artifacts", artifactH.Upload)
+							r.Get("/sbom", sbomH.GetForRun)
+							r.Get("/sbom/document", sbomH.GetDocumentForRun)
 						})
 					})
 					r.Get("/artifacts/{artifactID}/download", artifactH.Download)
 				r.Get("/artifacts/{artifactID}/signature", artifactH.GetSignature)
 				r.Get("/artifacts/{artifactID}/verify", artifactH.VerifySignature)
-							r.Get("/sbom", sbomH.GetForRun)
-							r.Get("/sbom/document", sbomH.GetDocumentForRun)
 					r.Route("/members", func(r chi.Router) {
 						r.Get("/", memberH.List)
 						r.With(csrf).Post("/", memberH.Add)