Repository navigation
feat(scan): add --dynamic-sbom-inference-ecosystems to choose which ecosystems use Socket facts - #1697
Conversation
767c973 to
8a7fd77
Compare
…cosystems use Socket facts scan create, scan reach and fix take purl types (maven covers Gradle, sbt and Maven; nuget covers .NET). Build tools of unselected types are not discovered, so their manifest files are used as they are and Coana does not treat them as facts-only; with --auto-manifest, auto-generation still runs for them at cwd. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
8a7fd77 to
31723a6
Compare
Oskar Haarklou Veileborg (BarrensZeppelin)
left a comment
Oskar Haarklou Veileborg (BarrensZeppelin)
left a comment
There was a problem hiding this comment.
Carried over from my review of #1696, since it merged with these open. Most of them are about code this PR doesn't touch, so they're below rather than inline.
The .NET SDK check runs per root inside the build loop (generate-recursive-manifests.mts). A later .NET root whose global.json pins a missing SDK aborts the run after earlier .NET roots were already built and wrote their facts files. fix resets those files, but scan create and scan reach leave them in the working tree, and the user waited for a build that can't be used. Checking every .NET root before building anything would make the "fails before building anything" test hold in general. Right now it holds only because the test has a single .NET root and dotnet comes first in BUILD_TOOLS.
The no-SDK error skips the JSON output (same lines). socket manifest dynamic-sbom-inference --json used to report a root without an SDK as a skippedNoSdk outcome. Now the InputError escapes handleManifestDynamicSbomInference before its CResult is built, so a script parsing the JSON gets no outcome list.
The wizard checks for an SDK only on one path (setup-recursive-manifest-config.mts). If the user answers no to "Configure other build roots found beneath this one, individually?" (line 853), the wizard reports "Recursive setup complete." without checking any nested .NET root, and the next --dynamic-sbom-inference run fails. On the individual path, returning ok: false looks like it aborts after earlier candidates' socket.json changes were written, leaving the setup half-applied.
Two versions of the no-SDK remedy (wizard and generation). The wizard's version omits the socket.json path and the defaults.manifest.dotnet.disabled option. A shared message builder next to noDotnetSdkReason would keep the two in sync.
useOnlySocketFactsArtifactsFlags accepts an empty list (coana.mts). An empty types produces ['--use-only-socket-facts-artifacts', ''], which Coana rejects with "Unsupported PURL type(s)". This PR can't produce an empty list, since cmdFlagValueToArray drops empty values and factsOnlyTypes comes from the discovered roots. A non-empty tuple type such as readonly [PURL_Type, ...PURL_Type[]] would still rule it out at compile time.
Drop the dedicated .NET SDK probe from --dynamic-sbom-inference and its setup wizard: a missing SDK now fails the build root the way a missing Maven does, so the run aborts through the usual failed-root path and --json lists the root. --auto-manifest keeps warning and skipping. Also write the sidecar whenever the facts-only flag is sent, for fix as for reach, type the facts-only types as non-empty, and order the result fields.
|
[agent] On the points carried over from #1696 (all in 6748a9d):
|
Oskar Haarklou Veileborg (BarrensZeppelin)
left a comment
Oskar Haarklou Veileborg (BarrensZeppelin)
left a comment
There was a problem hiding this comment.
Simplification notes, nothing blocking. The most useful are the single dynamicSbomInference field, the shared flag helper and dropping narrowed: together they remove the extra field, the copied code in the three commands and the duplicated messages.
One more that is outside the diff: generate_auto_manifest.mts:229 still skips a .NET root without an SDK through skipWithoutDotnetSdk. The second commit's reasoning ("fail like any other build") would apply to --auto-manifest too, and skipWithoutDotnetSdk in scripts/run.mts could then be deleted. If the skip is intentional there, a short comment saying why would help.
…ield - One `dynamicSbomInference` option holds the selected ecosystems, or undefined when off, in place of a boolean plus a list. - `parseDynamicSbomInferenceFlags` reads both flags for scan create, scan reach and fix. - Ecosystem lists are parsed case-insensitively and de-duplicated by one parser, which `fix --ecosystems` now uses too. - The "no build root" message names the selected build tools, and the flag's help lists the supported ecosystems from the build-tool table. - `--auto-manifest` fails a .NET build without a usable SDK, as it does a Maven build without Maven, instead of skipping it.
|
[agent] On |
LLM Description written by Claude Code:claude-opus-5-5
Adds
--dynamic-sbom-inference-ecosystemstosocket scan create,socket scan reachandsocket fix, so a repo can use Socket facts for some ecosystems and keep the manifest files of others as they are.maven(Gradle, sbt and Maven) andnuget(.NET). Without the flag, both are used, as before.--auto-manifest, auto-generation still runs for them at the scan root.--dynamic-sbom-inference, accepts any case, and rejects other ecosystems. Errors for "no build root found" name the selected build tools, and both that error and "no facts produced" suggest choosing other ecosystems.dynamicSbomInferenceoption carries the selection (undefined when off), read by one parser shared by the three commands.--reach-ecosystemsandfix --ecosystemsnow also accept any case, through the same ecosystem parser.Follow-ups to the #1696 review:
--jsonlists it as a failed root.--auto-manifestandsocket manifest autonow fail the same way instead of skipping the build.socket fixwrites the sidecar whenever it sends the facts-only flag, as reach does, and the facts-only types are typed non-empty.Tested: unit tests for discovery filtering, the selection passed through scan create, scan reach and fix, the auto-manifest interplay, and flag parsing; manual runs of the built CLI on a Maven + .NET directory (
mavenselected generates Maven facts and leaves .NET alone;nugetselected on a Maven-only dir fails with the narrowed message).🤖 Generated with Claude Code