edited ci file

internal/domain/ci/orchestrator.go

@@ -9,6 +9,7 @@ import (
 
 	"xorm.io/xorm"
 
+	"github.com/forgeo/forgebucket/internal/domain/sbom"
 	"github.com/forgeo/forgebucket/internal/events"
 	"github.com/forgeo/forgebucket/internal/models"
 )
@@ -17,12 +18,13 @@ import (
 // advances the DAG as jobs complete. It does NOT execute jobs directly —
 // that is the RunnerManager's responsibility.
 type Orchestrator struct {
-	db  *xorm.Engine
-	bus events.EventBus
+	db      *xorm.Engine
+	bus     events.EventBus
+	sbomGen *sbom.Generator
 }
 
-func NewOrchestrator(db *xorm.Engine, bus events.EventBus) *Orchestrator {
-	return &Orchestrator{db: db, bus: bus}
+func NewOrchestrator(db *xorm.Engine, bus events.EventBus, sbomGen *sbom.Generator) *Orchestrator {
+	return &Orchestrator{db: db, bus: bus, sbomGen: sbomGen}
 }
 
 // Start subscribes to relevant NATS subjects and blocks until ctx is cancelled.
@@ -142,7 +144,11 @@ func (o *Orchestrator) createRun(repo models.Repository, evt events.PushEvent, w
 
 	// Create job + step records for every job in the workflow.
 	for jobName, wfJob := range wf.Jobs {
-		needsJSON, _ := json.Marshal([]string(wfJob.Needs))
+		needs := []string(wfJob.Needs)
+		if needs == nil {
+			needs = []string{}
+		}
+		needsJSON, _ := json.Marshal(needs)
 		job := &models.PipelineJob{
 			RunID:  run.ID,
 			Name:   jobName,
@@ -231,6 +237,9 @@ func (o *Orchestrator) advanceDAG(runID, jobID int64, result string) {
 		run.FinishedAt = &now
 		o.db.ID(run.ID).Cols("status", "finished_at").Update(&run) //nolint:errcheck
 		o.bus.Publish(events.SubjectPipelineCompleted, events.PipelineEvent{RunID: run.ID, RepoID: run.RepoID, Status: "succeeded", At: now}) //nolint:errcheck
+		if o.sbomGen != nil {
+			go o.sbomGen.GenerateOnDemand(run.RepoID, run.ID, run.TriggerSHA)
+		}
 		return
 	}
 

internal/domain/sbom/generator.go

@@ -86,24 +86,32 @@ func (g *Generator) generateForRun(runID, repoID int64) {
 
 // GenerateOnDemand generates an SBOM for a specific repo + SHA and stores it
 // (or returns the cached one if the SHA was already processed).
-func (g *Generator) GenerateOnDemand(repoID int64, sha string) (*models.SBOMReport, error) {
-	// Return cached report for this exact SHA if one already exists.
-	var existing models.SBOMReport
-	if found, _ := g.db.Where("repo_id = ? AND sha = ?", repoID, sha).Get(&existing); found {
-		return &existing, nil
-	}
-
+func (g *Generator) GenerateOnDemand(repoID, runID int64, ref string) (*models.SBOMReport, error) {
 	var repo models.Repository
 	if found, _ := g.db.ID(repoID).Get(&repo); !found {
 		return nil, fmt.Errorf("repo %d not found", repoID)
 	}
 
+	// Resolve the ref to a full commit SHA — ref can be a branch name, tag, etc.
+	sha, err := gitdomain.RevParse(repo.DiskPath, ref)
+	if err != nil {
+		return nil, fmt.Errorf("rev-parse %s: %w", ref, err)
+	}
+
+	// Return cached report for this exact SHA + runID if one already exists.
+	// Without runID in the cache key, a prior on-demand generation (runID=0)
+	// would shadow subsequent per-run generation requests.
+	var existing models.SBOMReport
+	if found, _ := g.db.Where("repo_id = ? AND sha = ? AND run_id = ?", repoID, sha, runID).Get(&existing); found {
+		return &existing, nil
+	}
+
 	doc, err := Generate(repo.DiskPath, repo.Name, sha)
 	if err != nil {
 		return nil, err
 	}
 
-	report, err := g.persistAndReturn(repoID, 0, sha, doc)
+	report, err := g.persistAndReturn(repoID, runID, sha, doc)
 	if err != nil {
 		return nil, err
 	}