feat(state-hub): v0.3 schema — contributions + sbom_entries migrations, models, schemas, routers

Migrations (chain: b1c2d3e4f5a6 → c2d3e4f5a6b7 → d3e4f5a6b7c8):
- c2d3e4f5a6b7: contributions table (contributiontype BR/FR/EP/UPR enum,
  contributionstatus 7-state lifecycle, FKs to topics/workstreams)
- d3e4f5a6b7c8: sbom_entries table (ecosystem enum, snapshot-based replacement),
  + sbom_source + last_sbom_at columns on managed_repos

New models: Contribution (ContributionType, ContributionStatus), SBOMEntry (Ecosystem)
Modified: ManagedRepo (sbom_source, last_sbom_at columns)

New routers:
- /contributions/ — CRUD + lifecycle-guarded PATCH /status + soft-delete (withdrawn)
- /sbom/ — ingest (replace snapshot), list, per-repo view, licence report

Modified:
- /state/summary now includes contribution_counts and licence_risk_count
- main.py: registers contributions + sbom routers; bumps version to 0.6.0

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

api/schemas/contribution.py

@@ -0,0 +1,43 @@
+import uuid
+from datetime import datetime
+
+from pydantic import BaseModel, ConfigDict
+
+from api.models.contribution import ContributionStatus, ContributionType
+
+
+class ContributionCreate(BaseModel):
+    type: ContributionType
+    target_org: str | None = None
+    target_repo: str | None = None
+    slug: str | None = None
+    title: str
+    body_path: str | None = None
+    related_topic_id: uuid.UUID | None = None
+    related_workstream_id: uuid.UUID | None = None
+    notes: str | None = None
+
+
+class ContributionStatusPatch(BaseModel):
+    status: ContributionStatus
+    notes: str | None = None
+
+
+class ContributionRead(BaseModel):
+    model_config = ConfigDict(from_attributes=True)
+
+    id: uuid.UUID
+    type: ContributionType
+    target_org: str | None = None
+    target_repo: str | None = None
+    slug: str | None = None
+    title: str
+    status: ContributionStatus
+    body_path: str | None = None
+    related_topic_id: uuid.UUID | None = None
+    related_workstream_id: uuid.UUID | None = None
+    submitted_at: datetime | None = None
+    resolved_at: datetime | None = None
+    notes: str | None = None
+    created_at: datetime
+    updated_at: datetime

api/schemas/sbom.py

@@ -0,0 +1,54 @@
+import uuid
+from datetime import datetime
+
+from pydantic import BaseModel, ConfigDict
+
+from api.models.sbom_entry import Ecosystem
+
+
+class SBOMEntryCreate(BaseModel):
+    package_name: str
+    package_version: str | None = None
+    ecosystem: Ecosystem
+    license_spdx: str | None = None
+    is_direct: bool = True
+    is_dev: bool = False
+
+
+class SBOMIngest(BaseModel):
+    repo_slug: str
+    entries: list[SBOMEntryCreate]
+
+
+class SBOMEntryRead(BaseModel):
+    model_config = ConfigDict(from_attributes=True)
+
+    id: uuid.UUID
+    repo_id: uuid.UUID
+    package_name: str
+    package_version: str | None = None
+    ecosystem: Ecosystem
+    license_spdx: str | None = None
+    is_direct: bool
+    is_dev: bool
+    snapshot_at: datetime
+    created_at: datetime
+
+
+class LicenceGroup(BaseModel):
+    license_spdx: str | None
+    count: int
+    repos: list[str]
+    is_copyleft: bool
+
+
+class LicenceReport(BaseModel):
+    groups: list[LicenceGroup]
+    copyleft_direct_count: int
+
+
+class SBOMRepoView(BaseModel):
+    repo_slug: str
+    last_sbom_at: datetime | None = None
+    entry_count: int
+    entries: list[SBOMEntryRead]

api/schemas/state.py

@@ -77,3 +77,5 @@ class StateSummary(BaseModel):
     open_workstreams: list[WorkstreamWithDeps]
     next_steps: list[NextStep] = []
     domains: list[DomainSummary] = []
+    contribution_counts: dict[str, int] = {}
+    licence_risk_count: int = 0