Enhance SBOM handling with new types, resolvers, and tests

[ybelMekk]

A new GraphQL type for SBOM (Software Bill of Materials) metadata on container images, providing detailed SBOM pipeline status and processing information. The changes add a new sbom field to the ContainerImage type, deprecate the previous hasSBOM Boolean in favor of this richer status, and update the schema, resolvers, and integration tests accordingly.

GraphQL Schema and API Changes

• Added a new ContainerImageSBOM type with fields id, status, and processingStartedAt, and a new SBOMStatus enum to represent SBOM pipeline states (PROCESSING, READY, NO_SBOM, FAILED). The sbom field is now available on ContainerImage and returns this type, replacing the old hasSBOM Boolean (now deprecated).
• Marked the hasSBOM field as deprecated on both ContainerImage and WorkloadVulnerabilitySummary, instructing clients to use the new sbom.status field instead.

Resolver and Backend Implementation

• Added new resolver interfaces and implementations for the ContainerImageSBOM type and its fields, including wiring up complexity and field resolution logic in the generated backend code.

Integration Tests

• Updated integration tests to query the new sbom field and check for the correct SBOM status in test responses, ensuring the new API contract is exercised.

Dependency Updates

• Updated the dependency on github.com/nais/v13s/pkg/api to a newer version in go.mod.

[Copilot]

Pull request overview

This PR enhances the vulnerability/SBOM GraphQL API by introducing a richer SBOM model on ContainerImage (status + processing timestamp), deprecating the legacy hasSBOM boolean, and wiring the new types through resolvers plus integration test updates.

Changes:

• Add ContainerImage.sbom (new ContainerImageSBOM node + SBOMStatus enum) and deprecate hasSBOM usages in the schema.
• Introduce SBOM status/started-at resolver functions backed by a request-scoped dataloader for image summary fetching.
• Update fakes, issue checker logic, generated GraphQL code, and integration tests; bump github.com/nais/v13s/pkg/api.

Reviewed changes

Copilot reviewed 11 out of 16 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
internal/vulnerability/transform.go	Adjusts workload summary transformation (now conditionally builds vulnerability summary).
internal/vulnerability/queries.go	Routes v13s calls through new loader context; adds SBOM status and processing-start accessors.
internal/vulnerability/node.go	Registers ContainerImageSBOM as a Node type and provides ident parsing/lookup.
internal/vulnerability/models.go	Adds ContainerImageSBOM model and introduces SBOMStatus GraphQL enum plumbing.
internal/vulnerability/fake/v13s.go	Extends fake v13s responses with SBOM status info.
internal/vulnerability/dataloader.go	Introduces request-scoped loaders and an image summary dataloader.
internal/issue/checker/workload_v13s.go	Updates fake data + missing-SBOM detection logic to use SBOM status fields.
internal/graph/vulnerability.resolvers.go	Adds resolvers for ContainerImage.sbom and ContainerImageSBOM fields.
internal/graph/schema/vulnerability.graphqls	Defines ContainerImageSBOM and SBOMStatus; deprecates hasSBOM fields.
internal/graph/gengql/workloads.generated.go	Generated support for ContainerImage.sbom.
internal/graph/gengql/vulnerability.generated.go	Generated support for ContainerImageSBOM and SBOMStatus.
internal/graph/gengql/schema.generated.go	Generated Node union handling + schema updates for new types/fields.
internal/graph/gengql/root_.generated.go	Generated resolver root + complexity wiring for new SBOM fields.
integration_tests/vulnerabilities.lua	Updates integration query/expectations to include sbom { status }.
go.mod / go.sum	Bumps github.com/nais/v13s/pkg/api dependency to a newer revision.

Files not reviewed (4)

• internal/graph/gengql/root_.generated.go: Language not supported
• internal/graph/gengql/schema.generated.go: Language not supported
• internal/graph/gengql/vulnerability.generated.go: Language not supported
• internal/graph/gengql/workloads.generated.go: Language not supported

[Copilot]

Pull request overview

Copilot reviewed 11 out of 16 changed files in this pull request and generated 2 comments.

Files not reviewed (4)

• internal/graph/gengql/root_.generated.go: Language not supported
• internal/graph/gengql/schema.generated.go: Language not supported
• internal/graph/gengql/vulnerability.generated.go: Language not supported
• internal/graph/gengql/workloads.generated.go: Language not supported

[Copilot]

Pull request overview

Copilot reviewed 11 out of 16 changed files in this pull request and generated 2 comments.

Files not reviewed (4)

• internal/graph/gengql/root_.generated.go: Language not supported
• internal/graph/gengql/schema.generated.go: Language not supported
• internal/graph/gengql/vulnerability.generated.go: Language not supported
• internal/graph/gengql/workloads.generated.go: Language not supported