diff --git a/CHANGELOG.md b/CHANGELOG.md index c732fdf94..d47650007 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -8,18 +8,19 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/). ### Changed - Updated the Coana CLI to v `15.12.12`. +- JVM manifest generation now fails on dependencies the build tool only warns about or skips, instead of passing them into the scan without code: missing or invalid Maven POMs, missing `system` jars, jars coursier or Ivy could not fetch, failed Gradle project dependencies, artifacts failing Gradle dependency verification, and Gradle variants ambiguous in every configuration. +- To proceed past them, set `ignoreUnresolved`, and for reachability scans also pass `--reach-continue-on-install-errors`. +- An artifact with no checksum in Gradle's verification metadata no longer fails the run; it is left out of reachability analysis. ### Fixed - With `--dynamic-sbom-inference`, an sbt build that fails before writing its results is reported as failed instead of reusing another build's results. - `socket scan create --reach` keeps the private libraries and build modules of Socket facts files in the stored SBOM, with their dependencies under them. - JVM dependencies whose jars cannot be fetched, or are gone from disk, no longer reach reachability analysis looking resolved without code. - One unresolvable Maven dependency no longer strips the jar paths from every other dependency of its build, which made reachability analysis call their vulnerabilities unreachable. Jars that cannot be fetched are reported with their real cause, Maven 4 included. -- Maven dependencies with missing or invalid POMs are reported in every module that uses them, `system`-scope jars reach reachability analysis, and a failing dependency no longer fails scopes that `excludeConfigs` leaves out or the build when it lost a version conflict. +- Maven `system`-scope jars reach reachability analysis, and a failing Maven dependency no longer fails scopes that `excludeConfigs` leaves out, or the build when it lost a version conflict. - Reachability scans that hit unresolved JVM dependencies now point out that ignoring them also needs `--reach-continue-on-install-errors`. -- A Gradle dependency whose variant is ambiguous in every configuration of its project now fails the run instead of quietly dropping out of the scan. -- Gradle dependencies that fail dependency verification, or whose jars cannot be fetched, are reported instead of passed on as healthy. -- Failed Gradle project dependencies are reported instead of silently dropping everything they pull in, and failures name the version that actually failed. -- sbt dependencies whose jars coursier skips or Ivy fails to download are reported instead of passed off as POM-only modules, and POM-only, war and aar modules keep their real shape. +- JVM failures name the version that actually failed, and sbt POM-only, war and aar modules keep their real shape. +- A module excluded with `--exclude-paths` is still analysed as part of the projects that depend on it. ## [1.10.0](https://github.com/SocketDev/socket-cli/releases/tag/v1.10.0) - 2026-10-22 diff --git a/src/commands/manifest/cmd-manifest-auto.test.mts b/src/commands/manifest/cmd-manifest-auto.test.mts index 7025d5fac..2560bb92b 100644 --- a/src/commands/manifest/cmd-manifest-auto.test.mts +++ b/src/commands/manifest/cmd-manifest-auto.test.mts @@ -23,7 +23,7 @@ describe('socket manifest auto', async () => { $ socket manifest auto [options] [CWD=.] Options - --exclude-paths List of glob patterns to exclude from manifest/facts generation. Patterns are anchored micromatch globs matched relative to CWD (\`--cwd\` if set): \`tests\` matches only \`/tests\`; use \`**/tests\` to match at any depth. Negation patterns (\`!path\`) are not supported. Accepts a comma-separated value or multiple flags. + --exclude-paths List of glob patterns to exclude from manifest/facts generation. Patterns are anchored micromatch globs matched relative to CWD (\`--cwd\` if set): \`tests\` matches only \`/tests\`; use \`**/tests\` to match at any depth. Negation patterns (\`!path\`) are not supported. Accepts a comma-separated value or multiple flags. An excluded JVM build module is not analysed as a project of its own, but where a project that is not excluded depends on it, its code is analysed as part of that project. --verbose Enable debug output (only for auto itself; sub-steps need to have it pre-configured), may help when running into errors Tries to figure out what language your target repo uses. If it finds a diff --git a/src/commands/manifest/cmd-manifest-dynamic-sbom-inference.test.mts b/src/commands/manifest/cmd-manifest-dynamic-sbom-inference.test.mts index ed47e2b97..17ff1284f 100644 --- a/src/commands/manifest/cmd-manifest-dynamic-sbom-inference.test.mts +++ b/src/commands/manifest/cmd-manifest-dynamic-sbom-inference.test.mts @@ -33,7 +33,7 @@ describe('socket manifest dynamic-sbom-inference', async () => { CWD itself. Options - --exclude-paths List of glob patterns to exclude from manifest/facts generation. Patterns are anchored micromatch globs matched relative to CWD (\`--cwd\` if set): \`tests\` matches only \`/tests\`; use \`**/tests\` to match at any depth. Negation patterns (\`!path\`) are not supported. Accepts a comma-separated value or multiple flags. + --exclude-paths List of glob patterns to exclude from manifest/facts generation. Patterns are anchored micromatch globs matched relative to CWD (\`--cwd\` if set): \`tests\` matches only \`/tests\`; use \`**/tests\` to match at any depth. Negation patterns (\`!path\`) are not supported. Accepts a comma-separated value or multiple flags. An excluded JVM build module is not analysed as a project of its own, but where a project that is not excluded depends on it, its code is analysed as part of that project. --ignore-unresolved Warn on unresolved dependencies instead of failing the run (unresolved deps are not emitted to the facts files); overrides each build's socket.json setting --json Output as JSON --markdown Output as Markdown diff --git a/src/commands/manifest/cmd-manifest-gradle.test.mts b/src/commands/manifest/cmd-manifest-gradle.test.mts index 9d3b43e7b..f11c5fca6 100644 --- a/src/commands/manifest/cmd-manifest-gradle.test.mts +++ b/src/commands/manifest/cmd-manifest-gradle.test.mts @@ -25,7 +25,7 @@ describe('socket manifest gradle', async () => { Options --bin Location of the gradle binary to use, default: ./gradlew if present, else gradle on PATH --exclude-configs When generating facts: comma-separated glob patterns; Gradle configurations matching any pattern are skipped (applied after --include-configs) - --exclude-paths List of glob patterns to exclude from manifest/facts generation. Patterns are anchored micromatch globs matched relative to CWD (\`--cwd\` if set): \`tests\` matches only \`/tests\`; use \`**/tests\` to match at any depth. Negation patterns (\`!path\`) are not supported. Accepts a comma-separated value or multiple flags. + --exclude-paths List of glob patterns to exclude from manifest/facts generation. Patterns are anchored micromatch globs matched relative to CWD (\`--cwd\` if set): \`tests\` matches only \`/tests\`; use \`**/tests\` to match at any depth. Negation patterns (\`!path\`) are not supported. Accepts a comma-separated value or multiple flags. An excluded JVM build module is not analysed as a project of its own, but where a project that is not excluded depends on it, its code is analysed as part of that project. --facts Emit a Socket facts JSON file (\`gradle.socket.facts.json\`) describing the resolved dependency graph. This is the default; pass \`--pom\` to generate \`pom.xml\` files instead --gradle-opts Additional options to pass on to ./gradlew, see \`./gradlew --help\` --ignore-unresolved When generating facts: warn on unresolved dependencies instead of failing the run (unresolved deps are not emitted to the facts file) diff --git a/src/commands/manifest/cmd-manifest-kotlin.test.mts b/src/commands/manifest/cmd-manifest-kotlin.test.mts index 8ec957758..a774a767e 100644 --- a/src/commands/manifest/cmd-manifest-kotlin.test.mts +++ b/src/commands/manifest/cmd-manifest-kotlin.test.mts @@ -25,7 +25,7 @@ describe('socket manifest kotlin', async () => { Options --bin Location of the gradle binary to use, default: ./gradlew if present, else gradle on PATH --exclude-configs When generating facts: comma-separated glob patterns; Gradle configurations matching any pattern are skipped (applied after --include-configs) - --exclude-paths List of glob patterns to exclude from manifest/facts generation. Patterns are anchored micromatch globs matched relative to CWD (\`--cwd\` if set): \`tests\` matches only \`/tests\`; use \`**/tests\` to match at any depth. Negation patterns (\`!path\`) are not supported. Accepts a comma-separated value or multiple flags. + --exclude-paths List of glob patterns to exclude from manifest/facts generation. Patterns are anchored micromatch globs matched relative to CWD (\`--cwd\` if set): \`tests\` matches only \`/tests\`; use \`**/tests\` to match at any depth. Negation patterns (\`!path\`) are not supported. Accepts a comma-separated value or multiple flags. An excluded JVM build module is not analysed as a project of its own, but where a project that is not excluded depends on it, its code is analysed as part of that project. --facts Emit a Socket facts JSON file (\`gradle.socket.facts.json\`) describing the resolved dependency graph. This is the default; pass \`--pom\` to generate \`pom.xml\` files instead --gradle-opts Additional options to pass on to ./gradlew, see \`./gradlew --help\` --ignore-unresolved When generating facts: warn on unresolved dependencies instead of failing the run (unresolved deps are not emitted to the facts file) diff --git a/src/commands/manifest/cmd-manifest-maven.test.mts b/src/commands/manifest/cmd-manifest-maven.test.mts index 470f046d6..f11e19ca4 100644 --- a/src/commands/manifest/cmd-manifest-maven.test.mts +++ b/src/commands/manifest/cmd-manifest-maven.test.mts @@ -24,7 +24,7 @@ describe('socket manifest maven', async () => { Options --bin Location of the maven binary to use, default: ./mvnw if present, else mvn on PATH --exclude-configs Comma-separated glob patterns; Maven scopes matching any pattern are skipped (applied after --include-configs) - --exclude-paths List of glob patterns to exclude from manifest/facts generation. Patterns are anchored micromatch globs matched relative to CWD (\`--cwd\` if set): \`tests\` matches only \`/tests\`; use \`**/tests\` to match at any depth. Negation patterns (\`!path\`) are not supported. Accepts a comma-separated value or multiple flags. + --exclude-paths List of glob patterns to exclude from manifest/facts generation. Patterns are anchored micromatch globs matched relative to CWD (\`--cwd\` if set): \`tests\` matches only \`/tests\`; use \`**/tests\` to match at any depth. Negation patterns (\`!path\`) are not supported. Accepts a comma-separated value or multiple flags. An excluded JVM build module is not analysed as a project of its own, but where a project that is not excluded depends on it, its code is analysed as part of that project. --ignore-unresolved Warn on unresolved dependencies instead of failing the run (unresolved deps are not emitted to the facts file) --include-configs Comma-separated glob patterns matched against Maven dependency scopes (case-sensitive; \`*\`, \`?\`, and \`[...]\` wildcards). Only scopes matching at least one pattern are resolved. e.g. \`compile,runtime\`. Default: every scope --maven-opts Additional options to pass on to maven, e.g. \`-P -s \` diff --git a/src/commands/manifest/cmd-manifest-scala.test.mts b/src/commands/manifest/cmd-manifest-scala.test.mts index 24ffaffa5..43a2256e3 100644 --- a/src/commands/manifest/cmd-manifest-scala.test.mts +++ b/src/commands/manifest/cmd-manifest-scala.test.mts @@ -25,7 +25,7 @@ describe('socket manifest scala', async () => { Options --bin Location of sbt binary to use --exclude-configs When generating facts: comma-separated glob patterns; sbt configurations matching any pattern are skipped (applied after --include-configs) - --exclude-paths List of glob patterns to exclude from manifest/facts generation. Patterns are anchored micromatch globs matched relative to CWD (\`--cwd\` if set): \`tests\` matches only \`/tests\`; use \`**/tests\` to match at any depth. Negation patterns (\`!path\`) are not supported. Accepts a comma-separated value or multiple flags. + --exclude-paths List of glob patterns to exclude from manifest/facts generation. Patterns are anchored micromatch globs matched relative to CWD (\`--cwd\` if set): \`tests\` matches only \`/tests\`; use \`**/tests\` to match at any depth. Negation patterns (\`!path\`) are not supported. Accepts a comma-separated value or multiple flags. An excluded JVM build module is not analysed as a project of its own, but where a project that is not excluded depends on it, its code is analysed as part of that project. --facts Emit a Socket facts JSON file (\`sbt.socket.facts.json\`) describing the resolved dependency graph. This is the default; pass \`--pom\` to generate \`pom.xml\` files instead --ignore-unresolved When generating facts: warn on unresolved dependencies instead of failing the run (unresolved deps are not emitted to the facts file) --include-configs When generating facts: comma-separated glob patterns matched against sbt configuration names (case-sensitive; \`*\`, \`?\`, and \`[...]\` wildcards). Only configurations matching at least one pattern are resolved. e.g. \`compile,test\`. Default: compile,optional,provided,runtime,test diff --git a/src/commands/manifest/manifest-flags.mts b/src/commands/manifest/manifest-flags.mts index 5eab07653..39e8b85f3 100644 --- a/src/commands/manifest/manifest-flags.mts +++ b/src/commands/manifest/manifest-flags.mts @@ -8,6 +8,6 @@ export const excludePathsFlag: MeowFlags = { type: 'string', isMultiple: true, description: - 'List of glob patterns to exclude from manifest/facts generation. Patterns are anchored micromatch globs matched relative to CWD (`--cwd` if set): `tests` matches only `/tests`; use `**/tests` to match at any depth. Negation patterns (`!path`) are not supported. Accepts a comma-separated value or multiple flags.', + 'List of glob patterns to exclude from manifest/facts generation. Patterns are anchored micromatch globs matched relative to CWD (`--cwd` if set): `tests` matches only `/tests`; use `**/tests` to match at any depth. Negation patterns (`!path`) are not supported. Accepts a comma-separated value or multiple flags. An excluded JVM build module is not analysed as a project of its own, but where a project that is not excluded depends on it, its code is analysed as part of that project.', }, } diff --git a/src/commands/manifest/scripts/assemble.mts b/src/commands/manifest/scripts/assemble.mts index 682844970..81a7d1a19 100644 --- a/src/commands/manifest/scripts/assemble.mts +++ b/src/commands/manifest/scripts/assemble.mts @@ -91,6 +91,7 @@ export function assembleFacts( artifactPaths: buildArtifactPaths( finalNodes, [...parsed.projects.values()], + [...parsed.excludedProjects.values()], graphs, fileExists, ), @@ -410,6 +411,7 @@ function byProject( function buildArtifactPaths( finalNodes: Map, projects: RawProject[], + excludedProjects: RawProject[], graphs: Map, fileExists: (path: string) => boolean, ): ResolvedArtifactPaths { @@ -444,7 +446,7 @@ function buildArtifactPaths( } // A project's own component shares its id, so this also covers dependency // edges onto a sibling project. - for (const p of projects) { + for (const p of [...projects, ...excludedProjects]) { pathsById.set(p.projectKey, { sources: [...new Set(p.sources)].filter(fileExists).sort(), targets: [...new Set(p.targets)].filter(fileExists).sort(), diff --git a/src/commands/manifest/scripts/assemble.test.mts b/src/commands/manifest/scripts/assemble.test.mts index e58ad23c5..b78766fc5 100644 --- a/src/commands/manifest/scripts/assemble.test.mts +++ b/src/commands/manifest/scripts/assemble.test.mts @@ -115,6 +115,29 @@ describe('records → assemble → sidecar', () => { expect(bom?.targets).toEqual([]) expect(bom?.sources).toEqual([]) }) + it("carries an excluded module's paths into the kept project that depends on it", () => { + const records = [ + 'meta\tgradle\t8.10\t17', + 'project\t:app\tg\tapp\t1\tapp', + 'projectSrc\t:app\t/abs/app/src', + 'projectTgt\t:app\t/abs/app/classes', + 'excludedProject\t:lib', + 'projectSrc\t:lib\t/abs/lib/src', + 'projectTgt\t:lib\t/abs/lib/classes', + 'root\t0\t:app\tcompileClasspath\t1', + 'node\t0\t:lib\tg\tlib\t1\tjar\t\t1\t:lib', + ].join('\n') + const { artifactPaths, facts } = assembleFacts(parseRecords(records), { + fileExists: () => true, + }) + + expect(facts.projects?.map(p => p.id)).toEqual([':app']) + expect(artifactPaths.pathsById.get(':lib')).toEqual({ + sources: ['/abs/lib/src'], + targets: ['/abs/lib/classes'], + }) + expect([...artifactPaths.classpathByProject.keys()]).toEqual([':app']) + }) it('states no targets for an artifact that failed to resolve or is gone from disk', () => { const records = [ 'meta\tmaven\t3.9.6\t17', diff --git a/src/commands/manifest/scripts/maven-extension/src/main/java/tech/coana/socket/SocketFactsRecordsEngine.java b/src/commands/manifest/scripts/maven-extension/src/main/java/tech/coana/socket/SocketFactsRecordsEngine.java index bffac1783..27ad5081e 100644 --- a/src/commands/manifest/scripts/maven-extension/src/main/java/tech/coana/socket/SocketFactsRecordsEngine.java +++ b/src/commands/manifest/scripts/maven-extension/src/main/java/tech/coana/socket/SocketFactsRecordsEngine.java @@ -131,11 +131,16 @@ public void run(MavenSession session, List reactor, File rootDir, // own "no POM in this directory" error surface instead of an NPE. if (module.getBasedir() == null) continue; String ws = SocketSupport.workspace(rootDir.toPath(), module.getBasedir().toPath()); - if (SocketSupport.isExcludedPath(ws, excludes)) continue; String key = projectKey(module); - rec(lines, "project", key, module.getGroupId(), module.getArtifactId(), module.getVersion(), ws); - File pom = module.getFile(); - if (pom != null && pom.isFile()) rec(lines, "projectBuild", key, SocketSupport.relativePath(rootDir.toPath(), pom.toPath())); + boolean excluded = SocketSupport.isExcludedPath(ws, excludes); + if (excluded) { + // Not analysed on its own, but a kept module depending on it is analysed with its code. + if (opts.withFiles) rec(lines, "excludedProject", key); + } else { + rec(lines, "project", key, module.getGroupId(), module.getArtifactId(), module.getVersion(), ws); + File pom = module.getFile(); + if (pom != null && pom.isFile()) rec(lines, "projectBuild", key, SocketSupport.relativePath(rootDir.toPath(), pom.toPath())); + } if (opts.withFiles) { for (String s : collectSources(module)) rec(lines, "projectSrc", key, s); for (String t : collectTargets(module)) rec(lines, "projectTgt", key, t); diff --git a/src/commands/manifest/scripts/records.mts b/src/commands/manifest/scripts/records.mts index 570d4ad02..2e99cd630 100644 --- a/src/commands/manifest/scripts/records.mts +++ b/src/commands/manifest/scripts/records.mts @@ -13,6 +13,7 @@ import type { ResolutionFailure, Unscannable } from './resolution-report.mts' // projectSrc projectKey path (--with-files only) // projectTgt projectKey path (--with-files only) // projectBuild projectKey path (build-root-relative; may be absent on disk) +// excludedProject projectKey (--with-files only; paths without a project) // root rootId projectKey config prod(0|1) // node rootId coordId group name version ext classifier direct(0|1) project // edge rootId parentCoordId childCoordId @@ -80,6 +81,9 @@ export type ParsedRecords = { // directory-addressed build. entry: string projects: Map + // Excluded from the scan: not projects of their own, but their paths serve + // the kept projects depending on them. + excludedProjects: Map roots: Map scannedConfigs: string[] failures: ResolutionFailure[] @@ -115,12 +119,14 @@ export function parseRecords(text: string): ParsedRecords { buildRoot: '', entry: '', projects: new Map(), + excludedProjects: new Map(), roots: new Map(), scannedConfigs: [], failures: [], unscannable: [], } const scanned = new Set() + const excluded = new Set() const root = (id: string): RawRoot => { let r = result.roots.get(id) @@ -190,6 +196,9 @@ export function parseRecords(text: string): ParsedRecords { project(f[1] ?? '').targets.push(f[2]) } break + case 'excludedProject': + excluded.add(f[1] ?? '') + break case 'projectBuild': if (f[2]) { project(f[1] ?? '').buildFiles.push(f[2]) @@ -271,6 +280,13 @@ export function parseRecords(text: string): ParsedRecords { break } } + for (const key of excluded) { + const p = result.projects.get(key) + if (p) { + result.projects.delete(key) + result.excludedProjects.set(key, p) + } + } result.scannedConfigs = [...scanned].sort() return result } diff --git a/src/commands/manifest/scripts/socket-facts.init.gradle b/src/commands/manifest/scripts/socket-facts.init.gradle index 730f4698b..48272bde3 100644 --- a/src/commands/manifest/scripts/socket-facts.init.gradle +++ b/src/commands/manifest/scripts/socket-facts.init.gradle @@ -92,11 +92,9 @@ gradle.projectsEvaluated { g -> g.socketFactsState.projectGaByPath[p.path] = "${p.group ?: ''}:${p.name}".toString() g.socketFactsState.projectGavByPath[p.path] = "${p.group ?: ''}:${p.name}:${p.version ?: ''}".toString() // A wholly excluded subproject emits no project record and its configs are never resolved (see the - // collector). The project maps above stay populated so a KEPT project depending on it still - // recognizes it as a first-party module. - if (g.ext.socketIsExcluded.call(rel(p.projectDir))) { - return - } + // collector). The project maps above stay populated so a KEPT project depending on it + // still recognizes it as a first-party module, and its paths are kept so it is analysed with its code. + def excluded = g.ext.socketIsExcluded.call(rel(p.projectDir)) // Guarded: projects without the java `sourceSets` convention (pure aggregators, AGP-only // Android modules) contribute empty lists rather than failing. // ALL source sets are emitted (not just main/test) so custom ones (integrationTest, @@ -134,6 +132,7 @@ gradle.projectsEvaluated { g -> sources: (sources as List).sort(), targets: (targets as List).sort(), buildFiles: buildFiles, + excluded: excluded, ]) } } @@ -701,8 +700,12 @@ rootProject { rp -> def projectsInfo synchronized (state.projectsInfo) { projectsInfo = new ArrayList(state.projectsInfo) } projectsInfo.each { pi -> - rec(['project', pi.path, pi.group ?: '', pi.name, pi.version ?: '', pi.dir]) - pi.buildFiles.each { f -> rec(['projectBuild', pi.path, f]) } + if (pi.excluded) { + if (withFilesProjects) rec(['excludedProject', pi.path]) + } else { + rec(['project', pi.path, pi.group ?: '', pi.name, pi.version ?: '', pi.dir]) + pi.buildFiles.each { f -> rec(['projectBuild', pi.path, f]) } + } if (withFilesProjects) { pi.sources.each { s -> rec(['projectSrc', pi.path, s]) } pi.targets.each { t -> rec(['projectTgt', pi.path, t]) } diff --git a/src/commands/manifest/scripts/socket-facts.plugin.scala b/src/commands/manifest/scripts/socket-facts.plugin.scala index abed42818..810d3aaa5 100644 --- a/src/commands/manifest/scripts/socket-facts.plugin.scala +++ b/src/commands/manifest/scripts/socket-facts.plugin.scala @@ -117,21 +117,24 @@ object SocketFactsPlugin extends AutoPlugin { rec("buildRoot", rootCanonPath.toString) // One `project` record per build module (sources/targets only with --with-files). Excluded - // subprojects are omitted (they were also skipped during resolution above). + // subprojects get none (they were also skipped during resolution above), but keep their paths so + // a kept project depending on one is analysed with its code. allRefs.foreach { ref => - if (!isExcludedRef(ref)) { - val mid = rootIdOf(extracted, ref) - val ver = if (mid.revision == null) "" else mid.revision + val mid = rootIdOf(extracted, ref) + val ver = if (mid.revision == null) "" else mid.revision + if (isExcludedRef(ref)) { + if (withFiles) rec("excludedProject", ref.project) + } else { val baseDir = extracted.get(baseDirectory.in(ref)) rec("project", ref.project, mid.organization, mid.name, ver, relOf(baseDir)) (buildFilesByRef.getOrElse(ref, Nil) ++ baseBuildSbt(baseDir, rootCanonPath).map(relOf)).distinct.sorted .foreach(f => rec("projectBuild", ref.project, f)) - if (withFiles) { - moduleDirs.get(mid.organization + ":" + mid.name + ":" + ver).foreach { - case (sources, targets) => - sources.foreach(s => rec("projectSrc", ref.project, s)) - targets.foreach(t => rec("projectTgt", ref.project, t)) - } + } + if (withFiles) { + moduleDirs.get(mid.organization + ":" + mid.name + ":" + ver).foreach { + case (sources, targets) => + sources.foreach(s => rec("projectSrc", ref.project, s)) + targets.foreach(t => rec("projectTgt", ref.project, t)) } } } diff --git a/src/commands/scan/cmd-scan-create.test.mts b/src/commands/scan/cmd-scan-create.test.mts index 98d7bc032..3a73bb78e 100644 --- a/src/commands/scan/cmd-scan-create.test.mts +++ b/src/commands/scan/cmd-scan-create.test.mts @@ -105,7 +105,7 @@ describe('socket scan create', async () => { --cwd working directory, defaults to process.cwd() --default-branch Set the default branch of the repository to the branch of this full-scan. Should only need to be done once, for example for the "main" or "master" branch. --dynamic-sbom-inference For Gradle, sbt, and Maven: generate a Socket facts SBOM (produced directly by each package manager) per independent build root, instead of one synthetic root. Combine with --reach to split the reachability analysis per project/module. - --exclude-paths List of glob patterns to exclude from the scan, including SCA/SBOM manifest discovery and (when --reach is enabled) full application reachability analysis. Patterns are anchored micromatch globs matched relative to the Socket scan root, which is the command working directory (\`--cwd\` if set), not the reachability target: \`tests\` matches only \`/tests\`; use \`**/tests\` to match at any depth. Negation patterns (\`!path\`) are not supported. Accepts a comma-separated value or multiple flags. + --exclude-paths List of glob patterns to exclude from the scan, including SCA/SBOM manifest discovery and (when --reach is enabled) full application reachability analysis. Patterns are anchored micromatch globs matched relative to the Socket scan root, which is the command working directory (\`--cwd\` if set), not the reachability target: \`tests\` matches only \`/tests\`; use \`**/tests\` to match at any depth. Negation patterns (\`!path\`) are not supported. Accepts a comma-separated value or multiple flags. An excluded JVM build module is not analysed as a project of its own, but where a project that is not excluded depends on it, its code is analysed as part of that project. --interactive Allow for interactive elements, asking for input. Use --no-interactive to prevent any input questions, defaulting them to cancel/no. --json Output as JSON --markdown Output as Markdown diff --git a/src/commands/scan/cmd-scan-reach.test.mts b/src/commands/scan/cmd-scan-reach.test.mts index 4917a96ce..2a76381e0 100644 --- a/src/commands/scan/cmd-scan-reach.test.mts +++ b/src/commands/scan/cmd-scan-reach.test.mts @@ -38,7 +38,7 @@ describe('socket scan reach', async () => { Reachability Options --dynamic-sbom-inference For Gradle, sbt, and Maven: generate a Socket facts SBOM (produced directly by each package manager) per independent build root, instead of one synthetic root. The reachability analysis is split per project/module accordingly. - --exclude-paths List of glob patterns to exclude from the scan, including SCA/SBOM manifest discovery and (when --reach is enabled) full application reachability analysis. Patterns are anchored micromatch globs matched relative to the Socket scan root, which is the command working directory (\`--cwd\` if set), not the reachability target: \`tests\` matches only \`/tests\`; use \`**/tests\` to match at any depth. Negation patterns (\`!path\`) are not supported. Accepts a comma-separated value or multiple flags. + --exclude-paths List of glob patterns to exclude from the scan, including SCA/SBOM manifest discovery and (when --reach is enabled) full application reachability analysis. Patterns are anchored micromatch globs matched relative to the Socket scan root, which is the command working directory (\`--cwd\` if set), not the reachability target: \`tests\` matches only \`/tests\`; use \`**/tests\` to match at any depth. Negation patterns (\`!path\`) are not supported. Accepts a comma-separated value or multiple flags. An excluded JVM build module is not analysed as a project of its own, but where a project that is not excluded depends on it, its code is analysed as part of that project. --reach-analysis-memory-limit The maximum memory for the reachability analysis as a whole number optionally followed by MB or GB (e.g. 512MB, 8GB). The default is 8GB. --reach-analysis-timeout Set the timeout for the reachability analysis as a whole number optionally followed by s, m or h (e.g. 90s, 10m, 1h). Defaults to 10m. Split analysis runs may cause the total scan time to exceed this timeout significantly. --reach-concurrency Set the maximum number of concurrent reachability analysis runs. It is recommended to choose a concurrency level that ensures each analysis run has at least the --reach-analysis-memory-limit amount of memory available. diff --git a/src/commands/scan/reachability-flags.mts b/src/commands/scan/reachability-flags.mts index 2b598e1ac..a69854864 100644 --- a/src/commands/scan/reachability-flags.mts +++ b/src/commands/scan/reachability-flags.mts @@ -142,6 +142,6 @@ export const excludePathsFlag: MeowFlags = { type: 'string', isMultiple: true, description: - 'List of glob patterns to exclude from the scan, including SCA/SBOM manifest discovery and (when --reach is enabled) full application reachability analysis. Patterns are anchored micromatch globs matched relative to the Socket scan root, which is the command working directory (`--cwd` if set), not the reachability target: `tests` matches only `/tests`; use `**/tests` to match at any depth. Negation patterns (`!path`) are not supported. Accepts a comma-separated value or multiple flags.', + 'List of glob patterns to exclude from the scan, including SCA/SBOM manifest discovery and (when --reach is enabled) full application reachability analysis. Patterns are anchored micromatch globs matched relative to the Socket scan root, which is the command working directory (`--cwd` if set), not the reachability target: `tests` matches only `/tests`; use `**/tests` to match at any depth. Negation patterns (`!path`) are not supported. Accepts a comma-separated value or multiple flags. An excluded JVM build module is not analysed as a project of its own, but where a project that is not excluded depends on it, its code is analysed as part of that project.', }, }