socketsecurity 2.11.6__tar.gz → 2.11.10__tar.gz

{socketsecurity-2.11.6 → socketsecurity-2.11.10}/.github/actions/setup-docker/action.yml

@@ -22,7 +22,7 @@ runs:
     - uses: docker/setup-qemu-action@99012661954931238ded8c8b007157a8430204e1 # v4.4.0
       if: inputs.enable-qemu == 'true'
     - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
-    - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
+    - uses: docker/login-action@81c6f93d4bc991e510b342a00b419b3bb4efc5c6 # v4.7.0
       with:
         username: ${{ inputs.dockerhub-username }}
         password: ${{ inputs.dockerhub-token }}

{socketsecurity-2.11.6 → socketsecurity-2.11.10}/.github/actions/setup-sfw/action.yml

@@ -27,7 +27,7 @@ runs:
   using: "composite"
   steps:
     - if: ${{ inputs.python == 'true' || inputs.uv == 'true' }}
-      uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+      uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
       with:
         python-version: "3.12"
 

{socketsecurity-2.11.6 → socketsecurity-2.11.10}/.github/workflows/dependency-audit.yml

@@ -40,7 +40,7 @@ jobs:
           persist-credentials: false
 
       - name: 🐍 setup python
-        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
         with:
           python-version: ${{ env.PYTHON_VERSION }}
 

{socketsecurity-2.11.6 → socketsecurity-2.11.10}/.github/workflows/dependency-review.yml

@@ -150,7 +150,7 @@ jobs:
             echo "sha=${{ github.event.pull_request.head.sha }}"
           } > sfw-artifacts/context.txt
 
-      - uses: ./.github/actions/setup-sfw
+      - uses: $/.github/actions/setup-sfw
         with:
           uv: "true"
           mode: firewall-free
@@ -241,7 +241,7 @@ jobs:
             echo "sha=${{ github.event.pull_request.head.sha }}"
           } > sfw-artifacts/context.txt
 
-      - uses: ./.github/actions/setup-sfw
+      - uses: $/.github/actions/setup-sfw
         with:
           uv: "true"
           mode: firewall-enterprise
@@ -332,7 +332,7 @@ jobs:
             echo "sha=${{ github.event.pull_request.head.sha }}"
           } > sfw-artifacts/context.txt
 
-      - uses: ./.github/actions/setup-sfw
+      - uses: $/.github/actions/setup-sfw
         with:
           node: "true"
           mode: firewall-free
@@ -393,7 +393,7 @@ jobs:
             echo "sha=${{ github.event.pull_request.head.sha }}"
           } > sfw-artifacts/context.txt
 
-      - uses: ./.github/actions/setup-sfw
+      - uses: $/.github/actions/setup-sfw
         with:
           node: "true"
           mode: firewall-enterprise
@@ -454,7 +454,7 @@ jobs:
             echo "sha=${{ github.event.pull_request.head.sha }}"
           } > sfw-artifacts/context.txt
 
-      - uses: ./.github/actions/setup-sfw
+      - uses: $/.github/actions/setup-sfw
         with:
           python: "true"
           mode: firewall-free
@@ -518,7 +518,7 @@ jobs:
             echo "sha=${{ github.event.pull_request.head.sha }}"
           } > sfw-artifacts/context.txt
 
-      - uses: ./.github/actions/setup-sfw
+      - uses: $/.github/actions/setup-sfw
         with:
           python: "true"
           mode: firewall-enterprise

{socketsecurity-2.11.6 → socketsecurity-2.11.10}/.github/workflows/docker-stable.yml

@@ -29,7 +29,7 @@ jobs:
           echo "Version ${INPUT_VERSION} found on PyPI - proceeding with release"
 
       - name: Set up Docker publishing
-        uses: ./.github/actions/setup-docker
+        uses: $/.github/actions/setup-docker
         with:
           dockerhub-username: ${{ secrets.DOCKERHUB_USERNAME }}
           dockerhub-token: ${{ secrets.DOCKERHUB_TOKEN }}

{socketsecurity-2.11.6 → socketsecurity-2.11.10}/.github/workflows/e2e-test.yml

@@ -80,7 +80,7 @@ jobs:
           fetch-depth: 0
           persist-credentials: false
 
-      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+      - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
         with:
           python-version: '3.12'
 

{socketsecurity-2.11.6 → socketsecurity-2.11.10}/.github/workflows/package-check.yml

@@ -23,12 +23,12 @@ jobs:
           fetch-depth: 1
           persist-credentials: false
 
-      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+      - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
         with:
           python-version: "3.12"
 
       - name: Install build tooling
-        uses: ./.github/actions/setup-hatch
+        uses: $/.github/actions/setup-hatch
 
       - name: Install distribution validator
         run: python -m pip install "twine>=4.0.0"

{socketsecurity-2.11.6 → socketsecurity-2.11.10}/.github/workflows/pr-preview.yml

@@ -107,12 +107,12 @@ jobs:
           fetch-depth: 0
           persist-credentials: false
 
-      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+      - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
         with:
           python-version: "3.12"
 
       - name: Install build tooling
-        uses: ./.github/actions/setup-hatch
+        uses: $/.github/actions/setup-hatch
 
       - name: Install distribution validator
         run: python -m pip install "twine>=4.0.0"
@@ -179,7 +179,7 @@ jobs:
           path: dist
 
       - name: Publish to TestPyPI
-        uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2
+        uses: pypa/gh-action-pypi-publish@7245906fb61fa33a13554f9d5fb856fe61758086 # v1.14.3
         with:
           repository-url: https://test.pypi.org/legacy/
           verbose: true
@@ -252,7 +252,7 @@ jobs:
           path: dist
 
       - name: Set up Docker publishing
-        uses: ./.github/actions/setup-docker
+        uses: $/.github/actions/setup-docker
         with:
           # QEMU is required to build the arm64 layer on an amd64 runner.
           enable-qemu: "true"

{socketsecurity-2.11.6 → socketsecurity-2.11.10}/.github/workflows/python-tests.yml

@@ -36,7 +36,7 @@ jobs:
           fetch-depth: 1
           persist-credentials: false
       - name: 🐍 setup python
-        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
         with:
           python-version: ${{ env.PYTHON_VERSION }}
       - name: 🛠️ install deps
@@ -68,7 +68,7 @@ jobs:
           fetch-depth: 1
           persist-credentials: false
       - name: 🐍 setup python
-        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
         with:
           python-version: ${{ env.PYTHON_VERSION }}
       - name: 🛠️ install deps
@@ -88,7 +88,7 @@ jobs:
           fetch-depth: 1
           persist-credentials: false
       - name: 🐍 setup python
-        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
         with:
           python-version: "3.10"
       - name: 🚫 verify install is rejected on unsupported python

{socketsecurity-2.11.6 → socketsecurity-2.11.10}/.github/workflows/release.yml

@@ -9,17 +9,18 @@ jobs:
     permissions:
       id-token: write
       contents: read
+      issues: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
           persist-credentials: false
-      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+      - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
         with:
           python-version: '3.13'
 
       - name: Install build tooling
-        uses: ./.github/actions/setup-hatch
+        uses: $/.github/actions/setup-hatch
 
       - name: Get Version
         id: version
@@ -66,10 +67,10 @@ jobs:
 
       - name: Publish to PyPI
         if: steps.version_check.outputs.pypi_exists != 'true'
-        uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2
+        uses: pypa/gh-action-pypi-publish@7245906fb61fa33a13554f9d5fb856fe61758086 # v1.14.3
 
       - name: Set up Docker publishing
-        uses: ./.github/actions/setup-docker
+        uses: $/.github/actions/setup-docker
         with:
           dockerhub-username: ${{ secrets.DOCKERHUB_USERNAME }}
           dockerhub-token: ${{ secrets.DOCKERHUB_TOKEN }}
@@ -123,3 +124,44 @@ jobs:
             socketdev/cli:${{ env.VERSION }}
           build-args: |
             CLI_VERSION=${{ env.VERSION }}
+
+      # Releases are immutable, so a failed run leaves a published GitHub release whose
+      # tag can never be reused, with nothing on PyPI or Docker Hub behind it. A failed
+      # run only notifies whoever published the release, so raise it where the team
+      # will see it.
+      - name: Open an issue for the failed release
+        if: failure()
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+        env:
+          VERSION: ${{ env.VERSION }}
+        with:
+          script: |
+            const release = context.payload.release;
+            const runUrl =
+              `${context.serverUrl}/${context.repo.owner}/${context.repo.repo}` +
+              `/actions/runs/${context.runId}`;
+            const body = [
+              `@SocketDev/customer-engineering the release workflow for [${release.tag_name}](${release.html_url}) ` +
+                `(published by @${release.author.login}) failed: ${runUrl}`,
+              '',
+              `- Tag: \`${release.tag_name}\``,
+              `- Package version at that commit: \`${process.env.VERSION || 'unknown'}\``,
+              '',
+              'Check the run for which step failed. If it failed before "Publish to PyPI", nothing reached PyPI or ' +
+                'Docker Hub, but the GitHub release is immutable and its tag can never be reused.',
+              '',
+              'Before publishing another release:',
+              '',
+              '1. Edit this release\'s notes to say it was not published and name the release that replaces it.',
+              '2. If the tag and the package version disagree, merge a PR that bumps the version to one with no ' +
+                'existing tag (the Version Check workflow enforces this), then publish a release whose tag matches ' +
+                'that version exactly. Do not pick the next tag number from the releases list.',
+            ].join('\n');
+
+            const created = await github.rest.issues.create({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              title: `Release ${release.tag_name} failed`,
+              body,
+            });
+            core.error(`Release failed; opened #${created.data.number}`);

{socketsecurity-2.11.6 → socketsecurity-2.11.10}/.github/workflows/version-check.yml

@@ -44,6 +44,7 @@ jobs:
           python3 <<'PY'
           import json
           import os
+          import subprocess
           import tomllib
           import urllib.request
           from packaging import version
@@ -96,6 +97,21 @@ jobs:
               )
               raise SystemExit(1)
 
+          # Releases are immutable: once a v<version> release is published, its tag can't
+          # be moved or reused, even when that release failed and nothing reached PyPI.
+          # PyPI alone misses that, so a burned tag would only surface when the release
+          # run fails after the merge.
+          tag = f"v{os.environ['PR_VERSION']}"
+          if subprocess.run(
+              ["git", "rev-parse", "--quiet", "--verify", f"refs/tags/{tag}"],
+              capture_output=True,
+          ).returncode == 0:
+              print(
+                  f"❌ Tag {tag} already exists, so {pr_ver} can never be released "
+                  f"(latest PyPI release: {pypi_ver}). Bump to a version with no tag."
+              )
+              raise SystemExit(1)
+
           if pr_ver < main_ver:
               print(
                   f"❌ Version moves backwards: main is {main_ver}, PR is {pr_ver}."

{socketsecurity-2.11.6 → socketsecurity-2.11.10}/CHANGELOG.md

@@ -1,5 +1,27 @@
 # Changelog
 
+## 2.11.10
+
+Versions 2.11.7 through 2.11.9 were never published to PyPI or Docker Hub. The
+GitHub releases tagged `v2.11.8` and `v2.11.9` have no packages behind them;
+their changes ship here.
+
+### Fixed: report why a new repository couldn't be created
+
+- When a repository isn't in Socket yet and the API token can't create it, the
+  CLI now logs the failure, the HTTP status, and on a 403 a hint about the
+  `repo:create` scope before exiting `2`. Previously it exited `2` right after
+  file discovery with nothing logged.
+- After the CLI creates a missing repository, its logging is no longer silenced
+  for the rest of the run.
+
+### Changed: bump pinned Coana CLI to 15.14.0
+
+- Bumped the pinned reachability engine (the Coana CLI) from `15.13.2` to
+  `15.14.0`. See the
+  [reachability analysis changelog](https://docs.socket.dev/docs/reachability-analysis-changelog)
+  for engine changes.
+
 ## 2.11.6
 
 ### Added: `--reach-disable-dependency-downloads`

{socketsecurity-2.11.6 → socketsecurity-2.11.10}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: socketsecurity
-Version: 2.11.6
+Version: 2.11.10
 Summary: Socket Security CLI for CI/CD
 Project-URL: Homepage, https://socket.dev
 Author-email: Douglas Coburn <douglas@socket.dev>
@@ -38,7 +38,7 @@ Requires-Dist: brotli==1.2.1; platform_python_implementation == 'CPython'
 Requires-Dist: brotlicffi==1.2.1.0; platform_python_implementation != 'CPython'
 Requires-Dist: certifi>=2026.10.19
 Requires-Dist: gitpython==3.2.1
-Requires-Dist: markdown==3.11.1
+Requires-Dist: markdown==3.11.2
 Requires-Dist: mdutils==1.8.1
 Requires-Dist: packaging==26.3
 Requires-Dist: prettytable==3.18.0
@@ -48,13 +48,13 @@ Requires-Dist: socketdev==3.6.1
 Provides-Extra: dev
 Requires-Dist: hatch==1.18.1; extra == 'dev'
 Requires-Dist: pre-commit==4.7.0; extra == 'dev'
-Requires-Dist: ruff==0.17.1; extra == 'dev'
+Requires-Dist: ruff==0.17.2; extra == 'dev'
 Requires-Dist: twine==7.0.0; extra == 'dev'
-Requires-Dist: uv==0.13.4; extra == 'dev'
+Requires-Dist: uv==0.13.5; extra == 'dev'
 Provides-Extra: test
 Requires-Dist: pytest-asyncio==1.4.0; extra == 'test'
 Requires-Dist: pytest-cov==7.1.0; extra == 'test'
-Requires-Dist: pytest-mock==3.16.0; extra == 'test'
+Requires-Dist: pytest-mock==3.17.0; extra == 'test'
 Requires-Dist: pytest-watch==4.2.0; extra == 'test'
 Requires-Dist: pytest==9.1.1; extra == 'test'
 Description-Content-Type: text/markdown

{socketsecurity-2.11.6 → socketsecurity-2.11.10}/docs/cli-reference.md

@@ -338,7 +338,7 @@ If you don't want to provide the Socket API Token every time then you can use th
 | Parameter                        | Required | Default | Description                                                                                                                |
 |:---------------------------------|:---------|:--------|:---------------------------------------------------------------------------------------------------------------------------|
 | `--reach`                          | False    | False   | Enable reachability analysis to identify which vulnerable functions are actually called by your code. Creates a full application reachability scan (`scan_type=socket_tier1`). |
-| `--reach-version`                  | False    | 15.13.2 | Version of the Coana CLI to use. Defaults to the pinned version that ships with this CLI release, so the engine only changes when you upgrade the Socket CLI. Pass `latest` to always use the newest published version (opt-in auto-update), or an explicit version (e.g. `1.2.3`) to pin it. |
+| `--reach-version`                  | False    | 15.14.0 | Version of the Coana CLI to use. Defaults to the pinned version that ships with this CLI release, so the engine only changes when you upgrade the Socket CLI. Pass `latest` to always use the newest published version (opt-in auto-update), or an explicit version (e.g. `1.2.3`) to pin it. |
 | `--reach-analysis-timeout`         | False    | 10m     | Timeout for each reachability analysis run, e.g. `90s`, `10m` or `1h`. Omitted by default, so coana applies its own default (`10m`). Alias: `--reach-timeout` |
 | `--reach-analysis-memory-limit`    | False    | 8GB     | Memory limit for each reachability analysis run, e.g. `512MB` or `8GB`. Omitted by default, so coana applies its own default (`8GB`). Alias: `--reach-memory-limit` |
 | `--reach-concurrency`              | False    | 1       | Control parallel analysis execution (must be >= 1). Omitted by default, so coana applies its own default.                  |

{socketsecurity-2.11.6 → socketsecurity-2.11.10}/pyproject.toml

@@ -6,7 +6,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "socketsecurity"
-version = "2.11.6"
+version = "2.11.10"
 requires-python = ">= 3.11"
 license = {"file" = "LICENSE"}
 dependencies = [
@@ -18,7 +18,7 @@ dependencies = [
     "python-dotenv==1.2.4",
     "socketdev==3.6.1",
     "beautifulsoup4==4.15.0",
-    "markdown==3.11.1",
+    "markdown==3.11.2",
     "brotli==1.2.1; platform_python_implementation == 'CPython'",
     "brotlicffi==1.2.1.0; platform_python_implementation != 'CPython'",
     # requests' CA bundle. A floor rather than an exact pin, so later trust-store
@@ -46,14 +46,14 @@ classifiers = [
 test = [
     "pytest==9.1.1",
     "pytest-cov==7.1.0",
-    "pytest-mock==3.16.0",
+    "pytest-mock==3.17.0",
     "pytest-asyncio==1.4.0",
     "pytest-watch==4.2.0"
 ]
 dev = [
-    "ruff==0.17.1",
+    "ruff==0.17.2",
     "twine==7.0.0", # for building
-    "uv==0.13.4",  # for dependency management
+    "uv==0.13.5",  # for dependency management
     "pre-commit==4.7.0",
     "hatch==1.18.1"
 ]

{socketsecurity-2.11.6 → socketsecurity-2.11.10}/socketsecurity/__init__.py

@@ -1,3 +1,3 @@
 __author__ = 'socket.dev'
-__version__ = '2.11.6'
+__version__ = '2.11.10'
 USER_AGENT = f'SocketPythonCLI/{__version__}'

{socketsecurity-2.11.6 → socketsecurity-2.11.10}/socketsecurity/core/__init__.py

@@ -20,7 +20,11 @@ if TYPE_CHECKING:
     from socketsecurity.config import CliConfig
 from git import Repo
 from socketdev import socketdev
-from socketdev.exceptions import APIFailure
+from socketdev.exceptions import (
+    APIFailure,
+    APIInsufficientQuota,
+    APIOrganizationNotAllowed,
+)
 from socketdev.fullscans import DiffArtifacts, FullScanParams, SocketArtifact
 from socketdev.org import Organization
 from socketdev.repos import RepositoryInfo
@@ -1505,8 +1509,11 @@ class Core:
             sdk_logger = logging_std.getLogger("socketdev")
             original_level = sdk_logger.level
             sdk_logger.setLevel(logging_std.CRITICAL)
-            response = self.sdk.repos.repo(self.config.org_slug, repo_slug, use_types=True)
-            sdk_logger.setLevel(original_level)
+            try:
+                response = self.sdk.repos.repo(self.config.org_slug, repo_slug, use_types=True)
+            finally:
+                # This module logs through "socketdev" too, so a failed lookup must not leave it muted.
+                sdk_logger.setLevel(original_level)
             if not response.success:
                 log.error(f"Failed to get repository: {response.status}")
                 # log.error(response.message)
@@ -1530,7 +1537,13 @@ class Core:
                     return response.data
 
             except APIFailure as e:
-                log.error(f"API failure while creating repository: {e}")
+                status = f" (HTTP {e.status_code})" if e.status_code else ""
+                # The SDK appends the request path and response headers after the first line,
+                # and some subclasses carry no message at all.
+                reason = str(e).split("\n", 1)[0] or type(e).__name__
+                log.error(f"API failure while creating repository {repo_slug}{status}: {reason}")
+                if e.status_code == 403 and not isinstance(e, (APIInsufficientQuota, APIOrganizationNotAllowed)):
+                    log.error("A 403 here usually means the API token is missing the repo:create scope.")
                 sys.exit(2) # Exit here with code 2. Code 1 indicates a successfully-detected security issue.
 
         return response.data

{socketsecurity-2.11.6 → socketsecurity-2.11.10}/socketsecurity/core/tools/reachability.py

@@ -22,7 +22,7 @@ log = logging.getLogger(__name__)
 # Pinned Coana CLI version. Bumped deliberately per Python CLI release so the
 # reachability engine version only changes through a standard pip upgrade (advance notice).
 # Pass --reach-version latest to opt into the newest published version instead.
-DEFAULT_COANA_CLI_VERSION: Final = "15.13.2"
+DEFAULT_COANA_CLI_VERSION: Final = "15.14.0"
 
 # Vendored from coana-package-manager, where it is generated; the only code that may read or
 # write the cache Coana shares with the Socket CLIs. See "Launching Coana" in that repo's

{socketsecurity-2.11.6 → socketsecurity-2.11.10}/tests/core/test_sdk_methods.py

@@ -1,5 +1,13 @@
+import logging
+
 import pytest
-from socketdev.exceptions import APIFailure
+from socketdev.exceptions import (
+    APIAccessDenied,
+    APIFailure,
+    APIInsufficientPermissions,
+    APIInsufficientQuota,
+    APIResourceNotFound,
+)
 from socketdev.fullscans import FullScanParams, FullScanStreamResponse, ScanType
 
 from socketsecurity.config import CliConfig
@@ -44,6 +52,65 @@ def test_get_repo_info(core, mock_sdk_with_responses):
     assert repo_info.id == "f639d6c9-acc3-4d8a-9fb5-2090ad651c7e"
     assert repo_info.head_full_scan_id == "head"
 
+
+def test_get_repo_info_logs_why_repo_creation_failed(core, mock_sdk_with_responses, caplog):
+    """A repo that isn't in Socket yet and can't be created exits 2 with the reason logged"""
+    mock_sdk_with_responses.repos.repo.side_effect = APIResourceNotFound(status_code=404)
+    # Mirrors the SDK, which appends the request path and response headers to the message
+    mock_sdk_with_responses.repos.post.side_effect = APIAccessDenied(
+        "Insufficient permissions\nPath: https://api.socket.dev/v0/orgs/test/repos\n\nHeaders:\nx-req: 1",
+        status_code=403,
+    )
+
+    with caplog.at_level(logging.INFO, logger="socketdev"), pytest.raises(SystemExit) as exit_info:
+        core.get_repo_info("new-repo")
+
+    assert exit_info.value.code == 2
+    messages = [record.getMessage() for record in caplog.records]
+    assert "Failed to get repository new-repo, attempting to create it" in messages
+    assert "API failure while creating repository new-repo (HTTP 403): Insufficient permissions" in messages
+    assert any("repo:create" in message for message in messages)
+
+
+@pytest.mark.parametrize(
+    ("error", "expected_reason", "expects_scope_hint"),
+    [
+        (APIInsufficientPermissions(status_code=403), "APIInsufficientPermissions", True),
+        (APIInsufficientQuota(status_code=403), "APIInsufficientQuota", False),
+    ],
+)
+def test_get_repo_info_repo_creation_failure_reason(
+        core, mock_sdk_with_responses, caplog, error, expected_reason, expects_scope_hint
+):
+    """Message-less SDK errors still name a reason, and only permission 403s get the scope hint"""
+    mock_sdk_with_responses.repos.repo.side_effect = APIResourceNotFound(status_code=404)
+    mock_sdk_with_responses.repos.post.side_effect = error
+
+    with caplog.at_level(logging.INFO, logger="socketdev"), pytest.raises(SystemExit):
+        core.get_repo_info("new-repo")
+
+    messages = [record.getMessage() for record in caplog.records]
+    assert f"API failure while creating repository new-repo (HTTP 403): {expected_reason}" in messages
+    assert any("repo:create" in message for message in messages) is expects_scope_hint
+
+
+def test_get_repo_info_restores_log_level_after_creating_repo(
+        core, mock_sdk_with_responses, repo_info_response, caplog
+):
+    """Creating a missing repo must not leave the socketdev logger muted for the rest of the run"""
+    mock_sdk_with_responses.repos.repo.side_effect = [
+        APIResourceNotFound(status_code=404),
+        repo_info_response,
+    ]
+    mock_sdk_with_responses.repos.post.return_value = {"id": "created"}
+
+    with caplog.at_level(logging.INFO, logger="socketdev"):
+        repo_info = core.get_repo_info("new-repo")
+        assert logging.getLogger("socketdev").level == logging.INFO
+
+    assert repo_info.id == "f639d6c9-acc3-4d8a-9fb5-2090ad651c7e"
+
+
 def test_get_head_scan_for_repo(core, mock_sdk_with_responses):
     """Test getting head scan ID for a repository"""
     head_scan_id = core.get_head_scan_for_repo("test")