fix(sbom): Do not pollute database with stale SBoM blobs

[zkdev]

SBoMs can be re-generated, however the technical digest used to reference the blobs is not stable. This leads to a situation where regeneration updates the referenced digest, but does not clean up the old blob, effectively polluting the database and letting it grow in size.

As a mitigation, introduce an explicit overwrite codepath which tackles deletion. Optionally, skip regeneration in case an SBoM exists for the artefact already (can be detected as OCM artefact identities are used instead of the technical blob referenece).

What this PR does / why we need it:

Which issue(s) this PR fixes:
Fixes #

Special notes for your reviewer:

Release note:

SBoM generator can no longer create stale SBoM blobs, leading to growing database size

[coderabbitai]

📝 Walkthrough

Walkthrough

The SBOM generator now supports explicit overwrite and skip behavior for existing SBOMs. It detects prior metadata, can return early without generating, and deletes the previous blob after a successful overwrite.

Changes

SBOM existing-output handling

Layer / File(s)	Summary
SBOM existence policy contract src/odg/model.py, src/odg/extensions_cfg.py, charts/bootstrapping/values.documentation.yaml	Adds the OnExist enum and SBOMGeneratorConfig.on_exist, with documented overwrite and skip options and overwrite as the default.
Existing SBOM detection and cleanup src/sbom_generator.py	Looks up existing SBOM metadata, skips generation when configured, permits a nullable result, and removes the previous blob after overwrite with retries while logging failures.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Sequence Diagram(s)

sequenceDiagram
  participant generate_sbom_for_artefact
  participant DeliveryServiceClient
  participant SBOMStorage
  generate_sbom_for_artefact->>DeliveryServiceClient: Query existing SBOM metadata
  DeliveryServiceClient-->>generate_sbom_for_artefact: Existing metadata or none
  generate_sbom_for_artefact->>SBOMStorage: Upload generated SBOM
  generate_sbom_for_artefact->>SBOMStorage: Delete previous blob on overwrite

Loading

Poem

A rabbit found an SBOM in the hay,
“Skip it,” said softly, and hopped away.
Or overwrite with a fresh leafy glow,
Then tidy the old blob below.
Configuration now guides the way!

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly matches the main change: preventing stale SBOM blobs from lingering during regeneration.
Description check	✅ Passed	The description follows the template and includes a clear summary and release note, but some sections are left blank or partially filled.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@src/sbom_generator.py`:
- Around line 385-397: Update the cleanup condition around old_digest and
extension_cfg.on_exist in the SBOM generation flow to also require that
old_digest differs from the newly computed digest. Preserve the existing
deletion and error-logging behavior when the digests differ, while skipping
deletion when they identify the same content.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: e5fe33f7-95ce-40c2-b5ee-af912cc74dd6

📥 Commits

Reviewing files that changed from the base of the PR and between 2cebaea and 628ae1d.

📒 Files selected for processing (4)

• charts/bootstrapping/values.documentation.yaml
• src/odg/extensions_cfg.py
• src/odg/model.py
• src/sbom_generator.py

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@src/sbom_generator.py`:
- Around line 190-214: Update find_existing_sbom_metadata so query_metadata
failures are not converted into a None result: remove the broad exception
fallback, or retry and then propagate the exception after retries are exhausted.
Preserve returning the first entry for successful non-empty responses and return
None only when the successful response is empty.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: ccdf1ccb-be16-4cc2-a996-9debacfd0902

📥 Commits

Reviewing files that changed from the base of the PR and between 43cf871 and 99d7fdc.

📒 Files selected for processing (4)

• charts/bootstrapping/values.documentation.yaml
• src/odg/extensions_cfg.py
• src/odg/model.py
• src/sbom_generator.py

🚧 Files skipped from review as they are similar to previous changes (3)

• charts/bootstrapping/values.documentation.yaml
• src/odg/model.py
• src/odg/extensions_cfg.py

[8R0WNI3]

/lgtm