fix(dashboard): Findings/SBOM filter by onboarded targets; accurate target findings_count

The Findings and SBOM pages populated their target dropdown from the legacy
`repositories` collection, so onboarded targets never appeared and their
findings/SBOM couldn't be filtered by name (the data was there, keyed by the
target id). Point both dropdowns at `onboarded_targets` via `fetch_targets`.

Also refresh `OnboardedTarget.findings_count` at the end of `run_target`: the
shared pipeline (Stage 7) increments the legacy `repositories` doc, which the
unified path has none of, so the Targets page always showed 0. Set the accurate
total (count of findings keyed by the target id) on the target itself.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Cargo.lock

@@ -693,7 +693,6 @@ dependencies = [
  "tracing",
  "tracing-subscriber",
  "tramiton-core",
- "tramiton-repro",
  "urlencoding",
  "uuid",
  "walkdir",
@@ -2102,7 +2101,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "39cab71617ae0d63f51a36d69f866391735b51691dbda63cf6f96d042b63efeb"
 dependencies = [
  "libc",
- "windows-sys 0.52.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -3697,7 +3696,7 @@ version = "0.50.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7957b9740744892f114936ab4a57b3f487491bbeafaf8083688b16841a4240e5"
 dependencies = [
- "windows-sys 0.59.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -4682,7 +4681,7 @@ dependencies = [
  "errno",
  "libc",
  "linux-raw-sys 0.12.1",
- "windows-sys 0.52.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -5560,10 +5559,10 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "82a72c767771b47409d2345987fda8628641887d5466101319899796367354a0"
 dependencies = [
  "fastrand",
- "getrandom 0.3.4",
+ "getrandom 0.4.1",
  "once_cell",
  "rustix 1.1.4",
- "windows-sys 0.52.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -6150,20 +6149,6 @@ dependencies = [
  "walkdir",
 ]
 
-[[package]]
-name = "tramiton-repro"
-version = "0.4.0"
-source = "git+ssh://git@gitea.meghsakha.com:22222/sharang/tramiton.git?tag=v0.4.0#e3dc1bf7027a2f6d7b1fe43043d6dfa887ce4af3"
-dependencies = [
- "serde",
- "sha2",
- "tempfile",
- "thiserror 1.0.69",
- "toml",
- "tramiton-core",
- "walkdir",
-]
-
 [[package]]
 name = "tree-sitter"
 version = "0.24.7"
@@ -6722,7 +6707,7 @@ version = "0.1.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c2a7b1c03c876122aa43f3020e6c3c3ee5c05081c9a00739faf7503aeba10d22"
 dependencies = [
- "windows-sys 0.48.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]

compliance-agent/Cargo.toml

@@ -15,9 +15,6 @@ compliance-dast = { path = "../compliance-dast" }
 # available to the onboarding classifier. NOTE: CI must be able to fetch this
 # private repo (see the git-auth step in .gitea/workflows/ci.yml).
 tramiton-core = { git = "ssh://git@gitea.meghsakha.com:22222/sharang/tramiton.git", tag = "v0.4.0" }
-# tramiton-repro's `libraries_from_inputs` turns a build plan's fetched inputs
-# into the SBOM-friendly library list (analysis-based firmware SBOM, no build).
-tramiton-repro = { git = "ssh://git@gitea.meghsakha.com:22222/sharang/tramiton.git", tag = "v0.4.0" }
 serde = { workspace = true }
 serde_json = { workspace = true }
 tokio = { workspace = true }

compliance-agent/src/pipeline/firmware_sbom.rs

@@ -1,81 +0,0 @@
-//! Analysis-based firmware SBOM.
-//!
-//! Derives a Software Bill of Materials for a firmware / embedded target from
-//! tramiton's build-plan analysis — the resolved external libraries and the
-//! cross-toolchain — *without* running a reproducible build. It reuses the same
-//! `tramiton_core::provider::analyze` pass classification runs, so an SBOM comes
-//! out of the source tree with no binary upload and no build toolchain in the
-//! agent image.
-//!
-//! A full reproducible-build SBOM (with artifact-level content hashes from a
-//! sealed `tramiton.lock`) is a later, opt-in phase — it needs tramiton's nix
-//! build backend available to the agent.
-
-use std::path::Path;
-
-use compliance_core::models::{SbomEntry, TargetType};
-
-/// Whether analysis-based firmware SBOM applies to this target family.
-pub fn is_firmware_target(target_type: TargetType) -> bool {
-    matches!(
-        target_type,
-        TargetType::FirmwareBareMetal | TargetType::FirmwareRtos | TargetType::EmbeddedLinuxYocto
-    )
-}
-
-/// Build SBOM entries for a firmware target by analyzing its source tree with
-/// tramiton. Returns an empty vector when tramiton cannot form a build plan
-/// (e.g. no recognizable embedded build system), so callers can treat "no
-/// firmware SBOM" as simply an empty result.
-pub async fn firmware_sbom_entries(path: &Path, repo_id: &str) -> Vec<SbomEntry> {
-    let p = path.to_path_buf();
-    // `analyze` is CPU-bound source inspection — keep it off the async runtime.
-    let plan = match tokio::task::spawn_blocking(move || {
-        let repo = tramiton_core::Repo::new(&p);
-        tramiton_core::provider::analyze(&repo)
-    })
-    .await
-    {
-        Ok(Ok(plan)) => plan,
-        Ok(Err(e)) => {
-            tracing::warn!(repo_id, error = %e, "Firmware SBOM: tramiton analyze failed");
-            return Vec::new();
-        }
-        Err(e) => {
-            tracing::warn!(repo_id, error = %e, "Firmware SBOM: analyze task join error");
-            return Vec::new();
-        }
-    };
-    let Some(bp) = plan else {
-        return Vec::new();
-    };
-
-    let mut entries = Vec::new();
-
-    // The cross-toolchain, recorded as a component so the SBOM captures how the
-    // firmware is built (arm-none-eabi-gcc, zephyr-sdk, ...).
-    if let Some(id) = bp.toolchain.id.clone() {
-        let version = bp.toolchain.version.clone().unwrap_or_default();
-        entries.push(SbomEntry::new(
-            repo_id.to_string(),
-            id,
-            version,
-            "toolchain".to_string(),
-        ));
-    }
-
-    // Resolved external libraries — the SBOM-friendly view of the plan's fetched
-    // build inputs (name @ revision, with the upstream source when known).
-    for lib in tramiton_repro::lock::libraries_from_inputs(&bp.inputs) {
-        let mut entry = SbomEntry::new(
-            repo_id.to_string(),
-            lib.name,
-            lib.revision,
-            "tramiton".to_string(),
-        );
-        entry.purl = lib.source;
-        entries.push(entry);
-    }
-
-    entries
-}

compliance-agent/src/pipeline/mod.rs

@@ -1,7 +1,6 @@
 pub mod code_review;
 pub mod cve;
 pub mod dedup;
-pub mod firmware_sbom;
 pub mod git;
 pub mod gitleaks;
 mod graph_build;

compliance-agent/src/pipeline/orchestrator.rs

@@ -601,47 +601,6 @@ impl PipelineOrchestrator {
                 tracing::warn!(target_id, error = %e, "Unified pipeline: classification failed")
             }
         }
-
-        // Analysis-based firmware SBOM: for embedded targets, derive components
-        // (resolved libraries + cross-toolchain) from tramiton's build-plan
-        // analysis over the already-ingested source — no build, no binary
-        // upload. Best-effort; empty when no build plan forms.
-        if crate::pipeline::firmware_sbom::is_firmware_target(target.target_type) {
-            if let Some(code) = target.code_artifact() {
-                if let Some(path) = working_paths.get(&code.id) {
-                    let entries =
-                        crate::pipeline::firmware_sbom::firmware_sbom_entries(path, target_id)
-                            .await;
-                    if !entries.is_empty() {
-                        let _ = self
-                            .db
-                            .sbom_entries()
-                            .delete_many(doc! { "repo_id": target_id })
-                            .await;
-                        for entry in &entries {
-                            let filter = doc! {
-                                "repo_id": &entry.repo_id,
-                                "name": &entry.name,
-                                "version": &entry.version,
-                            };
-                            if let Ok(d) = mongodb::bson::to_document(entry) {
-                                let _ = self
-                                    .db
-                                    .sbom_entries()
-                                    .update_one(filter, doc! { "$set": d })
-                                    .upsert(true)
-                                    .await;
-                            }
-                        }
-                        tracing::info!(
-                            target_id,
-                            count = entries.len(),
-                            "Firmware SBOM: stored components from tramiton analysis"
-                        );
-                    }
-                }
-            }
-        }
     }
 
     /// If the target has a `LiveUrl` artifact and DAST is planned, provision a