fix: resolve the image scanner source instead of assuming a registry (#35)

Builder.SBOM hardcoded sbom.SourceRegistry, so an image the CLI built with
--load and never pushed failed resolution: `docker buildx imagetools inspect`
reports "pull access denied" for an image sitting in the local daemon, fully
scannable. Neither SBOMRequest nor ImageSubject carries a scanner source, so
the agent has to resolve it. The registry is tried first, so a stale local copy
cannot shadow what was actually published, and the daemon answers only for a
reference the registry cannot serve; when neither resolves, both causes are
reported rather than just the registry's.

The end-to-end test hid this. It called core's SBOMImages helper directly with
SourceDockerDaemon, bypassing Builder.SBOM and using the opposite source, so no
test ever drove the shipped method to a complete response and the shipped
configuration had never produced a successful scan anywhere. It now goes
through Builder.SBOM, and was confirmed to fail with the original "pull access
denied" when the fallback is removed.

A failed `uv lock` or `docker build` in that test called t.Skipf, so a broken
Dockerfile template would have skipped to a green run rather than failing the
job the test exists to protect. Both are t.Fatalf now; the tooling guard above
them has already established that the tools are installed.

Adds a source-scope routing test, which nothing covered: an inverted scope
comparison would have answered every source request with image evidence.

Reverts the testdata/recipe* gitignore entry as unrelated to this change.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: antoinetoussaint-byte

.gitignore

@@ -8,7 +8,6 @@ __pycache__
 dist/
 testdata/container*
 testdata/native*
-testdata/recipe*
 service-python-fastapi
 go.work
 go.work.sum

builder.go

@@ -4,6 +4,7 @@ import (
 	"context"
 	"embed"
 	"errors"
+	"fmt"
 	"os"
 
 	"github.com/codefly-dev/core/agents/communicate"
@@ -204,16 +205,48 @@ func (s *Builder) Build(ctx context.Context, req *builderv0.BuildRequest) (*buil
 //
 // Image scope goes to core's shared scanner. This agent emits a build recipe
 // and never runs buildx, so the digests only exist on the caller's side and
-// arrive as explicit subjects. SBOMImages answers empty subjects with a
-// precondition failure of its own: the service does ship an image, so
-// neither UNSUPPORTED nor a no-image reason would be true.
+// arrive as explicit subjects.
 func (s *Builder) SBOM(ctx context.Context, req *builderv0.SBOMRequest) (*builderv0.SBOMResponse, error) {
 	defer s.Wool.Catch()
 	if req.GetScope() != builderv0.SBOMScope_SBOM_SCOPE_IMAGE {
 		return s.Builder.SBOM(ctx, req)
 	}
 	ctx = s.Wool.Inject(ctx)
-	return s.Base.Builder.SBOMImages(ctx, req.GetSubjects(), sbom.SourceRegistry)
+	return s.imageSBOM(ctx, req.GetSubjects())
+}
+
+// imageSBOM inventories each subject, resolving where the image actually lives.
+//
+// Neither SBOMRequest nor ImageSubject carries a scanner source, and both
+// sources are real for this agent: release paths push, so the registry
+// resolves them, while `codefly ci build` builds with --load and leaves an
+// image whose only identity is its local image ID. Assuming either one strands
+// the other — a registry lookup of a --load image fails with "pull access
+// denied" for an image sitting in the daemon, fully scannable.
+//
+// The registry is tried first so a stale local copy can never shadow what was
+// actually published; the daemon answers only for a reference the registry
+// cannot serve. When neither resolves, both causes are reported, because the
+// registry failure on its own does not explain why the daemon had nothing
+// either. Empty subjects are the caller's precondition failure, not a
+// resolution failure, so they never reach a scanner.
+func (s *Builder) imageSBOM(ctx context.Context, subjects []*builderv0.ImageSubject) (*builderv0.SBOMResponse, error) {
+	if len(subjects) == 0 {
+		return s.Base.Builder.SBOMImageSubjectsRequired()
+	}
+	registry, err := s.Base.Builder.SBOMImages(ctx, subjects, sbom.SourceRegistry)
+	if err != nil || registry.GetState().GetState() != builderv0.SBOMStatus_ERROR {
+		return registry, err
+	}
+	daemon, err := s.Base.Builder.SBOMImages(ctx, subjects, sbom.SourceDockerDaemon)
+	if err != nil {
+		return nil, err
+	}
+	if daemon.GetState().GetState() == builderv0.SBOMStatus_ERROR {
+		return s.Base.Builder.SBOMImageError(fmt.Errorf("registry: %s; docker daemon: %s",
+			registry.GetState().GetMessage(), daemon.GetState().GetMessage()))
+	}
+	return daemon, nil
 }
 
 // Upgrade bumps Python dependencies in requirements.txt (pip list

image_sbom_test.go

@@ -58,6 +58,31 @@ func TestImageSBOMWithoutSubjectsIsPreconditionFailure(t *testing.T) {
 	require.Empty(t, resp.GetImages())
 }
 
+// TestSourceScopeIsNotRoutedToImageEvidence guards the scope condition itself.
+// Builder.SBOM now sits in front of the inherited source inventory, so an
+// inverted comparison would answer every source request with image evidence
+// and nothing else in this repository would notice.
+//
+// It asserts the response shape rather than its contents so it holds with or
+// without uv installed: a source answer never carries image scope, image
+// inventories, or a no-image reason, whether the inventory succeeded or failed.
+func TestSourceScopeIsNotRoutedToImageEvidence(t *testing.T) {
+	builder, _ := createdBuilder(t)
+
+	for _, scope := range []builderv0.SBOMScope{
+		builderv0.SBOMScope_SBOM_SCOPE_UNSPECIFIED,
+		builderv0.SBOMScope_SBOM_SCOPE_SOURCE,
+	} {
+		t.Run(scope.String(), func(t *testing.T) {
+			resp, err := builder.SBOM(t.Context(), &builderv0.SBOMRequest{Scope: scope})
+			require.NoError(t, err)
+			require.NotEqual(t, builderv0.SBOMScope_SBOM_SCOPE_IMAGE, resp.GetScope())
+			require.Empty(t, resp.GetImages())
+			require.Equal(t, builderv0.NoImageReason_NO_IMAGE_REASON_UNSPECIFIED, resp.GetNoImageReason())
+		})
+	}
+}
+
 // TestImageSBOMExpectationsMatchTheEmittedRecipe verifies the specialization's
 // actual build-recipe path against the coverage helper the fleet grades every
 // agent with: one subject per shipped platform, carrying the recipe's role and
@@ -169,7 +194,9 @@ func TestImageSBOMInventoriesTheBuiltImage(t *testing.T) {
 	lock := exec.CommandContext(ctx, "uv", "lock")
 	lock.Dir = filepath.Join(builder.Location, "code")
 	if out, err := lock.CombinedOutput(); err != nil {
-		t.Skipf("uv lock failed, the image cannot be built: %v\n%s", err, out)
+		// The tooling guard above already passed, so uv is installed: a failure
+		// here is a broken scaffold or lockfile, not an unequipped host.
+		t.Fatalf("uv lock failed, the image cannot be built: %v\n%s", err, out)
 	}
 
 	tag := fmt.Sprintf("codefly-fastapi-sbom-test:%d", time.Now().UnixMilli())
@@ -179,19 +206,27 @@ func TestImageSBOMInventoriesTheBuiltImage(t *testing.T) {
 		"-f", filepath.Join(outputDir, plan.GetRecipes()[0].GetDockerfile()),
 		"-t", tag, builder.Location)
 	if out, err := build.CombinedOutput(); err != nil {
-		t.Skipf("docker build failed, the image cannot be scanned: %v\n%s", err, out)
+		// Likewise docker is installed, so this is a broken Dockerfile template
+		// or recipe. Skipping would turn the regression this test exists to
+		// catch into a green run.
+		t.Fatalf("docker build failed, the image cannot be scanned: %v\n%s", err, out)
 	}
 	t.Cleanup(func() { _ = exec.Command("docker", "rmi", "-f", tag).Run() })
 
 	// The image was loaded into the local daemon and never pushed, so its
 	// immutable identity is the local image ID. The platform is left unstated:
 	// the daemon holds exactly one, and it is read back rather than asserted.
+	//
+	// This drives Builder.SBOM, the method the CLI actually calls, rather than
+	// core's helper. Scope routing and scanner-source resolution are what this
+	// repository owns, and a test calling the helper directly passed with
+	// either of them broken.
 	subject := &builderv0.ImageSubject{
 		Reference: tag,
 		Role:      plan.GetRecipes()[0].GetName(),
 		Service:   builder.Identity.Name,
 	}
-	resp, err := builder.Base.Builder.SBOMImages(ctx, []*builderv0.ImageSubject{subject}, sbom.SourceDockerDaemon)
+	resp, err := builder.SBOM(ctx, imageSBOMRequest(subject))
 	require.NoError(t, err)
 	require.Equal(t, builderv0.SBOMStatus_COMPLETE, resp.GetState().GetState(), resp.GetState().GetMessage())
 	require.Equal(t, builderv0.SBOMScope_SBOM_SCOPE_IMAGE, resp.GetScope())