feat(web-ui): backend image-composition service

[arodage]

Merge Checklist

All boxes should be checked before merging the PR

• The changes in the PR have been built and tested
• Documentation has been updated to reflect the changes (or no doc update needed)
• Ready to merge

Description

Adds an internal/api package and an image-composer-tool serve subcommand that drives a real ICT image build end-to-end over REST, so a client can compose and build without the CLI. Implements the read + build path of the OpenAPI contract added in #727 (merged): manifest, compose, build, SSE logs, artifacts.

Endpoints:

• GET /api/v1/manifest -0 supported combinations + display labels (from an embedded, --manifest-overridable manifest.yaml)
• POST /api/v1/templates/compose - selection → resolved pre-authored template + summary (via config.LoadAndMergeTemplate)
• POST /api/v1/builds - build via ICT invocation (sudo -n scoped rule; ICT needs root for chroot/mounts); per-build isolated --work-dir
• GET /api/v1/builds/{id}/logs - live build logs over SSE; terminal complete/error event
• GET /api/v1/builds/{id}/artifacts - image + SBOM paths, parsed from ICT output

Notable: build state is mutex-guarded (race-free); artifacts parsed from ICT's authoritative output (immune to root-owned output dirs); localhost bind by default.

Scope note: this is the backend only. The React Basic-mode UI will be in next story (separate PR). The OpenAPI spec it implements landed in #727.

Any Newly Introduced Dependencies

None. Reuses existing deps (google/uuid, cobra, zap, yaml) and internal packages (config.LoadAndMergeTemplate).

How Has This Been Tested?

Automated:

• go build ./... and go vet ./internal/api/... clean; gofmt clean.
• go test -race ./internal/api/... clean; internal/api unit-test coverage ~78% (manifest, compose/manifest/artifacts handlers, build tracker + state, middleware, SSE).

Manual E2E on a build-capable host (curl):

Prerequisites

go build -o ./image-composer-tool ./cmd/image-composer-tool/
# Scoped passwordless sudoers rule (builds need root for chroot/mounts):
echo "$(whoami) ALL=(root) NOPASSWD: $(pwd)/image-composer-tool build *" \
  | sudo tee /etc/sudoers.d/ict-webui && sudo chmod 440 /etc/sudoers.d/ict-webui

Start the server (leave running)

./image-composer-tool serve --sudo --ict-binary "$(pwd)/image-composer-tool"
# -> "ICT web UI API listening on :8080"

1. Manifest: supported combinations + labels

curl -s localhost:8080/api/v1/manifest | python3 -m json.tool
# Expect: combinations[] (retail/robotics/fed-aero) + verticals/skus/platforms/targets

2. Compose: selection → resolved template + summary

curl -s -X POST localhost:8080/api/v1/templates/compose \
  -H 'Content-Type: application/json' \
  -d '{"vertical":"robotics","sku":"robotics-jazzy-ubuntu24","platform":"wcl","os":"ubuntu24","imageType":"iso"}' \
  | python3 -m json.tool
# Expect: template filename, YAML, summary{packageCount, partitionCount, ...}
# Negative: an unsupported combo -> HTTP 400 NO_MATCH

3. Start a build: returns a build ID

BID=$(curl -s -X POST localhost:8080/api/v1/builds \
  -H 'Content-Type: application/json' \
  -d '{"compose":{"vertical":"fed-aero","sku":"generic-handheld-blueprint","platform":"ptl","os":"ubuntu24","imageType":"raw"}}' \
  | python3 -c 'import sys,json;print(json.load(sys.stdin)["buildId"])')
echo "buildId=$BID"

4. Stream logs (SSE; blocks until done, minutes for a real build)

curl -sN localhost:8080/api/v1/builds/$BID/logs
# Expect: event: log lines streaming live, ending with
#   event: complete  data: {"status":"success","artifacts":[...]}

5. Artifacts: image + SBOM paths

curl -s localhost:8080/api/v1/builds/$BID/artifacts | python3 -m json.tool
# Expect: status "success" + artifacts[] with the .raw.gz image and spdx SBOM (clean absolute paths)

6. --manifest live-edit (no rebuild): edit internal/api/data/manifest.yaml, restart with serve --manifest internal/api/data/manifest.yaml, changes apply.

Prerequisite recap: builds require the scoped, passwordless sudoers rule shown above; without it POST /builds fails at the sudo step.

[Copilot]

Pull request overview

This PR introduces a new internal/api HTTP backend and a image-composer-tool serve subcommand to expose key image-composition workflows (manifest discovery, template composition, build execution, SSE log streaming, and artifact reporting) over a REST API, aligning with the Web UI contract established in #727.

Changes:

• Adds an internal/api server with endpoints for manifest, compose, builds, SSE logs, and artifacts.
• Executes end-to-end ICT builds per request (optionally via sudo -n) and tracks per-build state/logs in-memory.
• Adds unit tests for manifest parsing, compose/build handlers, SSE formatting, and artifact parsing/discovery; bumps coverage threshold slightly.

Reviewed changes

Copilot reviewed 15 out of 15 changed files in this pull request and generated 13 comments.

Show a summary per file

File	Description
internal/api/sse.go	SSE log streaming endpoint + event formatting helper
internal/api/server.go	Server config, construction, and HTTP server startup
internal/api/router.go	Route registration on Go ServeMux patterns
internal/api/middleware.go	CORS, request logging, panic recovery, JSON/error helpers
internal/api/manifest.go	Manifest model, embedded loading, template lookup
internal/api/handlers_read.go	GET /manifest and POST /templates/compose handlers
internal/api/handlers_artifacts.go	GET /builds/{id}/artifacts handler
internal/api/data/manifest.yaml	Embedded manifest mapping UI selections to templates
internal/api/builds.go	Build lifecycle tracking, command execution, artifact parsing/discovery
internal/api/builds_test.go	Tests for artifact parsing from real-ish log output
internal/api/api_test.go	Broad handler/unit tests for manifest/compose/build state/middleware/SSE
image-templates/generic-handheld-os-template.yml	Adds a new (very large) Ubuntu-based template
cmd/image-composer-tool/serve.go	New serve subcommand wiring CLI flags to API server config
cmd/image-composer-tool/main.go	Registers the new serve subcommand
.coverage-threshold	Increases repo coverage threshold from 68.4 to 68.5

[srmungar]

This concatenation will not work for IPV6 hosts.

[srmungar]

use more cleaner approach of merging the stdout and stderr streams. There is a potential race condition to access the same buffer by both the streams but with different priorities. preferred is cmd.CombinedOutput.