edited ci file

internal/domain/sbom/generator.go

@@ -86,24 +86,32 @@ func (g *Generator) generateForRun(runID, repoID int64) {
 
 // GenerateOnDemand generates an SBOM for a specific repo + SHA and stores it
 // (or returns the cached one if the SHA was already processed).
-func (g *Generator) GenerateOnDemand(repoID int64, sha string) (*models.SBOMReport, error) {
-	// Return cached report for this exact SHA if one already exists.
-	var existing models.SBOMReport
-	if found, _ := g.db.Where("repo_id = ? AND sha = ?", repoID, sha).Get(&existing); found {
-		return &existing, nil
-	}
-
+func (g *Generator) GenerateOnDemand(repoID, runID int64, ref string) (*models.SBOMReport, error) {
 	var repo models.Repository
 	if found, _ := g.db.ID(repoID).Get(&repo); !found {
 		return nil, fmt.Errorf("repo %d not found", repoID)
 	}
 
+	// Resolve the ref to a full commit SHA — ref can be a branch name, tag, etc.
+	sha, err := gitdomain.RevParse(repo.DiskPath, ref)
+	if err != nil {
+		return nil, fmt.Errorf("rev-parse %s: %w", ref, err)
+	}
+
+	// Return cached report for this exact SHA + runID if one already exists.
+	// Without runID in the cache key, a prior on-demand generation (runID=0)
+	// would shadow subsequent per-run generation requests.
+	var existing models.SBOMReport
+	if found, _ := g.db.Where("repo_id = ? AND sha = ? AND run_id = ?", repoID, sha, runID).Get(&existing); found {
+		return &existing, nil
+	}
+
 	doc, err := Generate(repo.DiskPath, repo.Name, sha)
 	if err != nil {
 		return nil, err
 	}
 
-	report, err := g.persistAndReturn(repoID, 0, sha, doc)
+	report, err := g.persistAndReturn(repoID, runID, sha, doc)
 	if err != nil {
 		return nil, err
 	}