Accept inline SBOM documents in mirror API

[abhinavgautam01]

Closes #145

Summary

Add support for submitting raw CycloneDX or SPDX JSON documents directly to POST /api/mirror.

This allows CI jobs to warm the proxy cache from an SBOM without creating a temporary file or invoking the CLI.

Changes

• Add an sbom field to mirror.JobRequest
• Create SBOMSource from inline SBOM data received by the API
• Refactor SBOMSource to consume raw bytes instead of reading files
• Move SBOM file reading into the proxy mirror CLI
• Add tests for byte-backed SBOM parsing and API requests
• Document inline SBOM mirror requests

Example

curl -X POST http://localhost:8080/api/mirror \
  -H "Content-Type: application/json" \
  -d '{"sbom":{"bomFormat":"CycloneDX","components":[{"purl":"pkg:npm/lodash@4.17.21"}]}}'

Validation

• go tool golangci-lint run ./...
• go vet ./...
• go build ./...
• go test -race ./...

[Copilot]

Pull request overview

Adds support for starting mirror jobs by submitting an inline CycloneDX/SPDX SBOM document to POST /api/mirror, enabling CI workflows to warm the proxy cache without writing SBOM files to disk.

Changes:

• Extend mirror.JobRequest with an sbom field and create SBOMSource from inline SBOM bytes.
• Refactor SBOMSource to consume raw bytes (and move SBOM file reads into the proxy mirror CLI).
• Add tests and update documentation/examples for inline SBOM mirror requests.

Reviewed changes

Copilot reviewed 8 out of 8 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
README.md	Documents inline SBOM usage and updates the Mirror API endpoint description.
docs/configuration.md	Adds an inline SBOM example for the Mirror API configuration docs.
internal/server/mirror_api_test.go	Adds an API test covering job creation from inline SBOM JSON.
internal/mirror/job.go	Adds sbom to JobRequest and enables SBOM-backed job sources.
internal/mirror/job_test.go	Adds a unit test validating SBOM requests map to SBOMSource.
internal/mirror/source.go	Refactors SBOMSource from path-based reads to byte-backed parsing.
internal/mirror/source_test.go	Updates SBOM parsing tests to use in-memory bytes instead of temp files.
cmd/proxy/main.go	Moves SBOM file reading into the CLI and passes bytes into SBOMSource.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.