refactor(cmd): route upload + sbom through httpclient, keep test injection (OD-30)

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: andrzej-janczak

cmd/upload.go

@@ -5,6 +5,7 @@ import (
 	"codacy/cli-v2/config"
 	"codacy/cli-v2/domain"
 	"codacy/cli-v2/plugins"
+	"codacy/cli-v2/utils/httpclient"
 	"encoding/json"
 	"fmt"
 	"io"
@@ -251,7 +252,11 @@ func resultsFinalWithProjectToken(commitUUID string, projectToken string) {
 	req.Header.Set("Content-Type", "application/json")
 	req.Header.Set("project-token", projectToken)
 
-	client := &http.Client{}
+	client, err := httpclient.New()
+	if err != nil {
+		fmt.Println("Error:", err)
+		return
+	}
 	resp, err := client.Do(req)
 	if err != nil {
 		fmt.Println("Error:", err)
@@ -269,7 +274,11 @@ func resultsFinalWithAPIToken(commitUUID string, apiToken string, provider strin
 	req.Header.Set("Content-Type", "application/json")
 	req.Header.Set("api-token", apiToken)
 
-	client := &http.Client{}
+	client, err := httpclient.New()
+	if err != nil {
+		fmt.Println("Error:", err)
+		return
+	}
 	resp, err := client.Do(req)
 	if err != nil {
 		fmt.Println("Error:", err)
@@ -341,7 +350,12 @@ func sendResultsWithProjectToken(payload []map[string]interface{}, commitUUID st
 	req.Header.Set("content-type", "application/json")
 	req.Header.Set("project-token", projectToken)
 
-	resp, err := http.DefaultClient.Do(req)
+	client, err := httpclient.New()
+	if err != nil {
+		fmt.Printf("Error creating http client: %v\n", err)
+		os.Exit(1)
+	}
+	resp, err := client.Do(req)
 	if err != nil {
 		fmt.Printf("Error sending results: %v\n", err)
 		os.Exit(1)
@@ -372,7 +386,12 @@ func sendResultsWithAPIToken(payload []map[string]interface{}, commitUUID string
 	req.Header.Set("content-type", "application/json")
 	req.Header.Set("api-token", apiToken)
 
-	resp, err := http.DefaultClient.Do(req)
+	client, err := httpclient.New()
+	if err != nil {
+		fmt.Printf("Error creating http client: %v\n", err)
+		os.Exit(1)
+	}
+	resp, err := client.Do(req)
 	if err != nil {
 		fmt.Printf("Error sending results: %v\n", err)
 		os.Exit(1)

cmd/upload_sbom.go

@@ -11,6 +11,7 @@ import (
 	"strings"
 	"time"
 
+	"codacy/cli-v2/utils/httpclient"
 	"codacy/cli-v2/utils/logger"
 
 	"github.com/fatih/color"
@@ -29,14 +30,25 @@ var (
 	sbomFormat    string
 	sbomBaseURL   string
 
-	sbomHTTPClient httpDoer = &http.Client{Timeout: 5 * time.Minute}
+	// sbomHTTPClient is nil by default and resolved lazily via defaultSBOMClient.
+	// Tests may set it to a stub implementing httpDoer.
+	sbomHTTPClient httpDoer
 )
 
 // httpDoer abstracts the Do method of http.Client for testing.
 type httpDoer interface {
 	Do(req *http.Request) (*http.Response, error)
 }
 
+// defaultSBOMClient returns the injected client if set, else a factory client
+// honoring proxy/TLS configuration.
+func defaultSBOMClient() (httpDoer, error) {
+	if sbomHTTPClient != nil {
+		return sbomHTTPClient, nil
+	}
+	return httpclient.New(httpclient.WithTimeout(5 * time.Minute))
+}
+
 func init() {
 	uploadSBOMCmd.Flags().StringVarP(&sbomAPIToken, "api-token", "a", "", "API token for Codacy API (required)")
 	uploadSBOMCmd.Flags().StringVarP(&sbomProvider, "provider", "p", "", "Git provider (gh, gl, bb) (required)")
@@ -239,7 +251,11 @@ func uploadSBOMToCodacy(sbomPath, imageName, tag string, params sbomUploadParams
 	req.Header.Set("Accept", "application/json")
 	req.Header.Set("api-token", params.apiToken)
 
-	resp, err := sbomHTTPClient.Do(req)
+	client, err := defaultSBOMClient()
+	if err != nil {
+		return fmt.Errorf("failed to create http client: %w", err)
+	}
+	resp, err := client.Do(req)
 	if err != nil {
 		return fmt.Errorf("request failed: %w", err)
 	}

cmd/upload_sbom_test.go

@@ -7,10 +7,25 @@ import (
 	"net/http/httptest"
 	"os"
 	"testing"
+	"time"
 
 	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
 )
 
+func TestDefaultSBOMClient_UsesHTTPClientFactory(t *testing.T) {
+	saved := sbomHTTPClient
+	defer func() { sbomHTTPClient = saved }()
+
+	sbomHTTPClient = nil // force default path
+	c, err := defaultSBOMClient()
+	require.NoError(t, err)
+	require.NotNil(t, c)
+	hc, ok := c.(*http.Client)
+	require.True(t, ok)
+	assert.Equal(t, 5*time.Minute, hc.Timeout)
+}
+
 type sbomTestState struct {
 	apiToken   string
 	provider   string