socketsecurity 2.6.11__tar.gz → 2.7.1__tar.gz

{socketsecurity-2.6.11 → socketsecurity-2.7.1}/CHANGELOG.md

@@ -1,5 +1,64 @@
 # Changelog
 
+## 2.7.1
+
+### Changed: bump pinned @coana-tech/cli to 15.10.36
+
+- Bumped the pinned reachability engine (`@coana-tech/cli`) from `15.10.32` to
+  `15.10.36`. See the [Coana changelogs](https://docs.coana.tech/changelogs) for
+  engine changes.
+
+## 2.7.0
+
+### Fixed: unreadable reachability facts no longer report a blocking package
+
+- Scans with no supported manifest files uploaded a zero-byte `.socket.facts.json`
+  placeholder. The API cannot parse that, and answers by adding a
+  `generic/invalid-socket-facts@1.0.0` artifact to the scan, which the CLI then reported
+  as a new blocking package with no manifest file and no introducing dependency —
+  failing the run and, on pull requests, leaving a security comment that could not be
+  acted on. The placeholder is now an empty but well-formed facts document.
+- When the API does report `generic/invalid-socket-facts` (a diagnostic for a facts file
+  it could not parse, not a real dependency), the CLI now excludes it from scan results
+  and logs a warning instead. It no longer blocks a run, appears in reports, or triggers
+  a pull request comment.
+- Each placeholder is written to its own temporary directory. Two CLI runs sharing a
+  temporary directory previously used the same path and could remove each other's
+  placeholder mid-upload.
+
+### Fixed: pull request comments no longer show orphaned tags or an empty table
+
+- Optional sections that rendered as empty, such as the ignore instructions
+  suppressed by `--disable-ignore`, left a whitespace-only line in the alerts
+  table. That line closed the surrounding HTML block, and the indented
+  `</blockquote></details>` tags after it were rendered as a literal code block.
+  Generated comment markup now omits blank lines and stays under the indentation
+  that starts a code block.
+- Alert descriptions, suggestions and license findings are collapsed onto a
+  single line so multi-line API text cannot break the table markup either.
+- When a pull request has no alerts left to report, the security comment is
+  replaced with a short confirmation instead of keeping the "Caution" banner
+  above a table with no rows. This happens both when a later commit resolves
+  every alert and when every alert is ignored by comment. The comment marker is
+  preserved, so a commit that reintroduces an alert updates the same comment
+  rather than posting a second one.
+- `@SocketSecurity ignore-all` now applies to comments written by CLI versions
+  before 2.0.55, which use the older Markdown alerts table. The check was made
+  once per ignore command, and an ignore-all comment produces none, so no rows
+  were removed.
+
+### Fixed: `--disable-security-issue` and `--disable-overview` now suppress the comment entirely
+
+- Both flags were checked only after testing whether a comment of that type was
+  already on the pull request, so they suppressed the first post and then
+  updated that comment on every later run. `--disable-security-issue` in
+  particular kept refreshing an existing comment with the full alerts table.
+- The flags now mean the CLI does not manage that comment at all. An existing
+  comment is left untouched rather than being rewritten, since a body claiming
+  no alerts would be inaccurate when reporting is merely switched off.
+- The decision moved into `should_write_comment()` so it is covered directly by
+  tests.
+
 ## 2.6.11
 
 ### Changed: bump pinned @coana-tech/cli to 15.10.32
@@ -31,7 +90,6 @@
 - Bumped the pinned reachability engine (`@coana-tech/cli`) from `15.10.23` to
   `15.10.25`. See the [Coana changelogs](https://docs.coana.tech/changelogs) for
   engine changes.
-
 ## 2.6.7
 
 ### Changed: bump pinned @coana-tech/cli to 15.10.23

{socketsecurity-2.6.11 → socketsecurity-2.7.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: socketsecurity
-Version: 2.6.11
+Version: 2.7.1
 Summary: Socket Security CLI for CI/CD
 Project-URL: Homepage, https://socket.dev
 Author-email: Douglas Coburn <douglas@socket.dev>
@@ -47,7 +47,7 @@ Requires-Dist: socketdev==3.5.0
 Provides-Extra: dev
 Requires-Dist: hatch==1.18.0; extra == 'dev'
 Requires-Dist: pre-commit==4.6.2; extra == 'dev'
-Requires-Dist: ruff==0.16.3; extra == 'dev'
+Requires-Dist: ruff==0.16.4; extra == 'dev'
 Requires-Dist: twine==7.0.0; extra == 'dev'
 Requires-Dist: uv==0.12.5; extra == 'dev'
 Provides-Extra: test

{socketsecurity-2.6.11 → socketsecurity-2.7.1}/docs/cli-reference.md

@@ -156,7 +156,7 @@ socketcli [-h] [--api-token API_TOKEN] [--repo REPO] [--workspace WORKSPACE] [--
           [--reach] [--reach-version REACH_VERSION] [--reach-analysis-timeout REACH_ANALYSIS_TIMEOUT]
           [--reach-analysis-memory-limit REACH_ANALYSIS_MEMORY_LIMIT] [--reach-concurrency REACH_CONCURRENCY] [--reach-ecosystems REACH_ECOSYSTEMS]
           [--reach-min-severity <level>] [--reach-skip-cache] [--reach-disable-analytics] [--reach-enable-analysis-splitting] [--reach-detailed-analysis-log-file]
-          [--reach-lazy-mode] [--reach-use-only-pregenerated-sboms] [--reach-debug] [--reach-disable-external-tool-checks]
+          [--reach-use-only-pregenerated-sboms] [--reach-debug] [--reach-disable-external-tool-checks]
           [--reach-output-file REACH_OUTPUT_FILE] [--only-facts-file] [--version]
 ````
 
@@ -275,7 +275,7 @@ If you don't want to provide the Socket API Token every time then you can use th
 | Parameter                        | Required | Default | Description                                                                                                                |
 |:---------------------------------|:---------|:--------|:---------------------------------------------------------------------------------------------------------------------------|
 | `--reach`                          | False    | False   | Enable reachability analysis to identify which vulnerable functions are actually called by your code. Creates a full application reachability scan (`scan_type=socket_tier1`). |
-| `--reach-version`                  | False    | 15.10.32 | Version of @coana-tech/cli to use. Defaults to the pinned version that ships with this CLI release, so the engine only changes when you upgrade the Socket CLI. Pass `latest` to always use the newest published version (opt-in auto-update), or an explicit version (e.g. `1.2.3`) to pin it. |
+| `--reach-version`                  | False    | 15.10.36 | Version of @coana-tech/cli to use. Defaults to the pinned version that ships with this CLI release, so the engine only changes when you upgrade the Socket CLI. Pass `latest` to always use the newest published version (opt-in auto-update), or an explicit version (e.g. `1.2.3`) to pin it. |
 | `--reach-analysis-timeout`         | False    | 10m     | Timeout for each reachability analysis run, e.g. `90s`, `10m` or `1h`. Omitted by default, so coana applies its own default (`10m`). Alias: `--reach-timeout` |
 | `--reach-analysis-memory-limit`    | False    | 8GB     | Memory limit for each reachability analysis run, e.g. `512MB` or `8GB`. Omitted by default, so coana applies its own default (`8GB`). Alias: `--reach-memory-limit` |
 | `--reach-concurrency`              | False    | 1       | Control parallel analysis execution (must be >= 1). Omitted by default, so coana applies its own default.                  |
@@ -286,7 +286,6 @@ If you don't want to provide the Socket API Token every time then you can use th
 | `--reach-disable-analytics`        | False    | False   | Disable analytics collection during reachability analysis                                                                  |
 | `--reach-enable-analysis-splitting` | False   | False   | Enable analysis splitting/bucketing (a legacy performance feature). Splitting is disabled by default.                      |
 | `--reach-detailed-analysis-log-file` | False  | False   | Write a detailed analysis log file; its path is printed to stdout                                                          |
-| `--reach-lazy-mode`                | False    | False   | Enable lazy mode (experimental performance feature)                                                                        |
 | `--reach-use-only-pregenerated-sboms` | False | False   | Build the scan only from pre-generated CycloneDX (CDX) and SPDX files in your project (requires --reach)                    |
 | `--reach-debug`                    | False    | False   | Enable coana debug output (`--debug`) for the analysis, independent of the global `--enable-debug`                         |
 | `--reach-disable-external-tool-checks` | False | False | Disable coana's external tool availability checks (passes `--disable-external-tool-checks`)                              |

{socketsecurity-2.6.11 → socketsecurity-2.7.1}/pyproject.toml

@@ -6,7 +6,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "socketsecurity"
-version = "2.6.11"
+version = "2.7.1"
 requires-python = ">= 3.11"
 license = {"file" = "LICENSE"}
 dependencies = [
@@ -47,7 +47,7 @@ test = [
     "pytest-watch==4.2.0"
 ]
 dev = [
-    "ruff==0.16.3",
+    "ruff==0.16.4",
     "twine==7.0.0", # for building
     "uv==0.12.5",  # for dependency management
     "pre-commit==4.6.2",

{socketsecurity-2.6.11 → socketsecurity-2.7.1}/socketsecurity/__init__.py

@@ -1,3 +1,3 @@
 __author__ = 'socket.dev'
-__version__ = '2.6.11'
+__version__ = '2.7.1'
 USER_AGENT = f'SocketPythonCLI/{__version__}'

{socketsecurity-2.6.11 → socketsecurity-2.7.1}/socketsecurity/config.py

@@ -176,7 +176,7 @@ class CliConfig:
     reach_disable_analysis_splitting: bool = False  # Deprecated, kept for backwards compatibility
     reach_enable_analysis_splitting: bool = False
     reach_detailed_analysis_log_file: bool = False
-    reach_lazy_mode: bool = False
+    reach_lazy_mode: bool = False  # Deprecated, kept for backwards compatibility
     reach_ecosystems: Optional[List[str]] = None
     reach_exclude_paths: Optional[List[str]] = None
     reach_skip_cache: bool = False
@@ -1091,7 +1091,7 @@ def create_argument_parser() -> argparse.ArgumentParser:
         "--reach-lazy-mode",
         dest="reach_lazy_mode",
         action="store_true",
-        help="Enable lazy mode for reachability analysis. This is an experimental feature for improving performance"
+        help=argparse.SUPPRESS  # Deprecated, kept for backwards compatibility (no-op)
     )
     reachability_group.add_argument(
         "--reach-output-file",

{socketsecurity-2.6.11 → socketsecurity-2.7.1}/socketsecurity/core/__init__.py

@@ -1,3 +1,4 @@
+import atexit
 import copy
 import fnmatch
 import importlib
@@ -6,6 +7,7 @@ import logging
 import os
 import random
 import re
+import shutil
 import sys
 import tarfile
 import tempfile
@@ -69,6 +71,16 @@ SOCKET_FACTS_BROTLI_LGWIN = 24
 # Stream the facts file in 1 MiB chunks so large files aren't held fully in memory.
 SOCKET_FACTS_BROTLI_CHUNK_SIZE = 1024 * 1024
 
+# Placeholder facts document (see empty_head_scan_file). A zero-byte file does not parse,
+# and the API answers an unparseable facts file with the marker artifact below.
+SOCKET_FACTS_EMPTY_DOCUMENT = '{"components": []}'
+
+# Synthetic artifact the API adds when an uploaded ``.socket.facts.json`` could not be
+# parsed. A diagnostic, not a dependency, so it is dropped from scan results and reported
+# as a warning instead.
+INVALID_FACTS_MARKER_TYPE = "generic"
+INVALID_FACTS_MARKER_NAME = "invalid-socket-facts"
+
 # Full application reachability finalize retry policy. The finalize call links the reachability
 # scan to the full scan and can fail transiently (network/API blips); a few backoff retries make it robust.
 TIER1_FINALIZE_MAX_ATTEMPTS = 3
@@ -108,6 +120,17 @@ DIFF_SCAN_POLL_MAX_INTERVAL_SECONDS = 10.0
 DIFF_SCAN_POLL_BACKOFF_MULTIPLIER = 1.5
 DIFF_SCAN_POLL_TIMEOUT_SECONDS = 30 * 60.0
 
+# Temp dirs holding placeholder facts files (see Core.empty_head_scan_file). Call sites unlink
+# the file itself once the upload finishes; the now-empty directory is removed at process exit
+# so a run that raises mid-scan doesn't leak one.
+_PLACEHOLDER_FACTS_DIRS: List[str] = []
+
+
+@atexit.register
+def _cleanup_placeholder_facts_dirs() -> None:
+    for placeholder_dir in _PLACEHOLDER_FACTS_DIRS:
+        shutil.rmtree(placeholder_dir, ignore_errors=True)
+
 
 def _humanize_alert_type(alert_type: str) -> str:
     """Convert a camelCase/PascalCase alert type into a Title-Cased label.
@@ -209,13 +232,54 @@ class Core:
             )
         if not hasattr(response, "artifacts") or not response.artifacts:
             return {}
-        return response.artifacts
+        artifacts = {
+            artifact_id: artifact
+            for artifact_id, artifact in response.artifacts.items()
+            if not Core.is_invalid_facts_marker(artifact)
+        }
+        Core.warn_if_invalid_facts_marker(len(artifacts) != len(response.artifacts))
+        return artifacts
 
     def get_sbom_data_list(self, artifacts_dict: Dict[str, SocketArtifact]) -> list[SocketArtifact]:
         """Converts artifacts dictionary to a list."""
         return list(artifacts_dict.values())
 
+    @staticmethod
+    def is_invalid_facts_marker(artifact) -> bool:
+        """True for the API's ``generic/invalid-socket-facts`` unparseable-facts marker.
+
+        Treated as a package it becomes a blocking alert with an empty "Introduced by" and
+        "Manifest File" that no developer can act on, so callers drop it and report the parse
+        failure through ``warn_if_invalid_facts_marker`` instead.
 
+        Matches any version; the API pins it to 1.0.0 but the version carries no meaning.
+
+        Args:
+            artifact: A ``SocketArtifact`` or diff artifact (anything with ``type``/``name``).
+
+        Returns:
+            True if the artifact is the marker rather than a real package.
+        """
+        return (
+            getattr(artifact, "type", None) == INVALID_FACTS_MARKER_TYPE
+            and getattr(artifact, "name", None) == INVALID_FACTS_MARKER_NAME
+        )
+
+    @staticmethod
+    def warn_if_invalid_facts_marker(found: bool) -> None:
+        """Log the parse failure that ``is_invalid_facts_marker`` stands for.
+
+        Dropping the marker silently would hide a real, if non-blocking, problem: the scan ran
+        without the reachability data it was supposed to carry.
+        """
+        if not found:
+            return
+        log.warning(
+            "Socket could not parse the uploaded .socket.facts.json, so reachability facts "
+            "were not applied to this scan. Ignoring the "
+            f"{INVALID_FACTS_MARKER_TYPE}/{INVALID_FACTS_MARKER_NAME} marker returned for it; "
+            "other scan results are unaffected."
+        )
 
     def create_sbom_output(self, diff: Diff) -> dict:
         """Creates CycloneDX output for a given diff."""
@@ -809,20 +873,31 @@ class Core:
     @staticmethod
     def empty_head_scan_file() -> List[str]:
         """
-        Creates a temporary empty file for baseline scans when no head scan exists.
-        
+        Creates a temporary placeholder manifest for scans with no manifest files.
+
+        Used for baseline scans when a repository has no head scan yet, and for the new scan
+        when no supported manifest files were found. The API rejects unsupported filenames, so
+        the placeholder must be named ``.socket.facts.json`` - which means it must also parse
+        as a facts document. A zero-byte file does not, and the API answers that by adding a
+        blocking ``generic/invalid-socket-facts@1.0.0`` artifact to the scan.
+
+        Each call gets its own temp directory. The path used to be a fixed
+        ``$TMPDIR/.socket.facts.json``, so two runs sharing a temp dir could delete or
+        truncate each other's placeholder mid-upload.
+
         Returns:
-            List containing path to a temporary empty file
+            List containing path to a temporary placeholder facts file
         """
-        # Create a temporary directory and then create our specific filename
-        temp_dir = tempfile.gettempdir()
-        temp_path = os.path.join(temp_dir, '.socket.facts.json')
-        
-        # Create the empty file
-        with open(temp_path, 'w'):
-            pass  # Creates an empty file
-        
-        log.debug(f"Created temporary empty file for baseline scan: {temp_path}")
+        # Own directory per call so concurrent runs can't clobber each other's placeholder;
+        # the basename must stay exactly SOCKET_FACTS_FILENAME to pass the API's validator.
+        temp_dir = tempfile.mkdtemp(prefix='socket_baseline_')
+        _PLACEHOLDER_FACTS_DIRS.append(temp_dir)
+        temp_path = os.path.join(temp_dir, SOCKET_FACTS_FILENAME)
+
+        with open(temp_path, 'w') as f:
+            f.write(SOCKET_FACTS_EMPTY_DOCUMENT)
+
+        log.debug(f"Created temporary placeholder facts file for baseline scan: {temp_path}")
         return [temp_path]
 
     def finalize_tier1_scan(self, full_scan_id: str, facts_file_path: str) -> bool:
@@ -959,7 +1034,7 @@ class Core:
         exactly ``.socket.facts.json.br``, so compressing here keeps a large facts file under
         the server's per-file size cap without changing the stored result. Files whose
         basename is not exactly ``.socket.facts.json`` are left untouched (the server only
-        matches that exact name), as are empty placeholder files (e.g. baseline scans).
+        matches that exact name), as are zero-byte files.
 
         Compression never blocks an upload: if it fails for any reason (missing optional
         ``brotli`` dependency, unwritable directory, etc.) the original plain file is used.
@@ -1780,16 +1855,25 @@ class Core:
 
         diff_end = time.time()
         log.info(f"Diff Report Gathered in {diff_end - diff_start:.2f} seconds")
+
+        # Left in, the invalid-socket-facts marker reads as a newly added blocking package.
+        # Drop it from every bucket before the counts below, which should describe what the
+        # CLI actually reports on.
+        marker_found = False
+        buckets: Dict[str, List] = {}
+        for name in ("added", "removed", "unchanged", "replaced", "updated"):
+            bucket = getattr(diff_artifacts, name)
+            buckets[name] = [a for a in bucket if not Core.is_invalid_facts_marker(a)]
+            marker_found = marker_found or len(buckets[name]) != len(bucket)
+        Core.warn_if_invalid_facts_marker(marker_found)
+
         log.info("Diff report artifact counts:")
-        log.info(f"Added: {len(diff_artifacts.added)}")
-        log.info(f"Removed: {len(diff_artifacts.removed)}")
-        log.info(f"Unchanged: {len(diff_artifacts.unchanged)}")
-        log.info(f"Replaced: {len(diff_artifacts.replaced)}")
-        log.info(f"Updated: {len(diff_artifacts.updated)}")
-
-        added_artifacts = diff_artifacts.added + diff_artifacts.updated
-        removed_artifacts = diff_artifacts.removed + diff_artifacts.replaced
-        unchanged_artifacts = diff_artifacts.unchanged
+        for name, bucket in buckets.items():
+            log.info(f"{name.capitalize()}: {len(bucket)}")
+
+        added_artifacts = buckets["added"] + buckets["updated"]
+        removed_artifacts = buckets["removed"] + buckets["replaced"]
+        unchanged_artifacts = buckets["unchanged"]
 
         added_packages: Dict[str, Package] = {}
         removed_packages: Dict[str, Package] = {}

{socketsecurity-2.6.11 → socketsecurity-2.7.1}/socketsecurity/core/messages.py

@@ -806,6 +806,90 @@ class Messages:
 
         return gitlab_report
 
+    # A blank line terminates a CommonMark HTML block. When that happens inside
+    # the alerts table the closing tags that follow are no longer treated as
+    # markup, and because they are indented four or more spaces they render as a
+    # literal code block containing `</blockquote></details>` instead.
+    MAX_HTML_INDENT = 3
+
+    @staticmethod
+    def inline_html_text(value) -> str:
+        """
+        Collapses API supplied text onto a single line.
+
+        Alert descriptions and suggestions are interpolated into the comment HTML,
+        so an embedded newline would otherwise be able to close the surrounding
+        HTML block early.
+
+        :param value: The value to flatten. ``None`` becomes an empty string.
+        :return: str - The value with all whitespace runs collapsed to a single space.
+        """
+        if value is None:
+            return ""
+        return " ".join(str(value).split())
+
+    @staticmethod
+    def normalize_comment_html(comment: str) -> str:
+        """
+        Makes generated comment markup safe for the CommonMark renderers used by
+        GitHub and GitLab.
+
+        Drops whitespace-only lines (an optional section that rendered as empty
+        leaves one behind) and caps indentation below the four spaces that would
+        start an indented code block. Intentional separators - lines that are
+        genuinely empty - are preserved so markdown blocks still break apart.
+
+        :param comment: str - The generated comment body.
+        :return: str - The comment body with unrenderable whitespace removed.
+        """
+        lines = []
+        for line in comment.split("\n"):
+            if line and not line.strip():
+                continue
+            stripped = line.lstrip()
+            indent = min(len(line) - len(stripped), Messages.MAX_HTML_INDENT)
+            lines.append(" " * indent + stripped)
+        return "\n".join(lines)
+
+    @staticmethod
+    def security_comment_no_alerts_template(view_report_url: str = "") -> str:
+        """
+        Generates the body used when there is nothing left to report.
+
+        Alerts raised on an early commit are frequently resolved later in the same
+        pull request. Rewriting the comment to this body keeps the Socket comment
+        in place - so a later commit that reintroduces an alert updates it rather
+        than posting a second comment - without leaving the "Caution" banner above
+        an empty alerts table.
+
+        :param view_report_url: str - Optional link to the full Socket report.
+        :return: str - The formatted Markdown/HTML string.
+        """
+        lines = [
+            "<!-- socket-security-comment-actions -->",
+            "",
+            "> **✅ Socket Security**  ",
+            "> No dependency alerts to report. Any alerts previously reported on this "
+            "pull request have been resolved or ignored.",
+        ]
+        if view_report_url:
+            lines += ["", f"[View full report]({view_report_url})"]
+        return "\n".join(lines) + "\n"
+
+    @staticmethod
+    def get_view_report_url(diff: Diff) -> str:
+        """
+        Resolves the report link for a diff, preferring the PR/MR diff view.
+
+        :param diff: Diff - Diff report to pull the URL from.
+        :return: str - The report URL, or an empty string when neither is set.
+        """
+        if getattr(diff, "diff_url", None):
+            return diff.diff_url
+        if getattr(diff, "report_url", None):
+            return diff.report_url
+        return ""
+
     @staticmethod
     def security_comment_template(diff: Diff, config=None) -> str:
         """
@@ -819,7 +903,7 @@ class Messages:
         # Group license policy violations by PURL (ecosystem/package@version)
         license_groups = {}
         security_alerts = []
-        
+
         for alert in diff.new_alerts:
             if alert.type == "licenseSpdxDisj":
                 purl_key = f"{alert.pkg_type}/{alert.pkg_name}@{alert.pkg_version}"
@@ -829,6 +913,13 @@ class Messages:
             else:
                 security_alerts.append(alert)
 
+        view_report_url = Messages.get_view_report_url(diff)
+
+        # Without this the caution banner would sit above a table with no rows,
+        # which is how a comment looks once every alert it raised is resolved.
+        if not security_alerts and not license_groups:
+            return Messages.security_comment_no_alerts_template(view_report_url)
+
         # Start of the comment
         comment = """<!-- socket-security-comment-actions -->
 
@@ -875,15 +966,15 @@ class Messages:
   </td>
   <td>
     <details {details_open}>
-      <summary>{alert.pkg_name}@{alert.pkg_version} - {alert.title}</summary>
-      <p><strong>Note:</strong> {alert.description}</p>
+      <summary>{alert.pkg_name}@{alert.pkg_version} - {Messages.inline_html_text(alert.title)}</summary>
+      <p><strong>Note:</strong> {Messages.inline_html_text(alert.description)}</p>
       <p><strong>Source:</strong> <a href="{manifest_url}">Manifest File</a></p>
       <p>ℹ️ Read more on:
       <a href="{alert.purl}">This package</a> |
       <a href="{alert.url}">This alert</a> |
       <a href="https://socket.dev/alerts/malware">What is known malware?</a></p>
       <blockquote>
-        <p><em>Suggestion:</em> {alert.suggestion}</p>
+        <p><em>Suggestion:</em> {Messages.inline_html_text(alert.suggestion)}</p>
         {ignore_html}
       </blockquote>
     </details>
@@ -917,7 +1008,7 @@ class Messages:
       <ul>
 """
             for finding in license_findings:
-                comment += f"        <li>{finding}</li>\n"
+                comment += f"        <li>{Messages.inline_html_text(finding)}</li>\n"
             
             
             # Generate proper manifest URL for license violations
@@ -944,13 +1035,6 @@ class Messages:
     """
 
         # Close table
-        # Use diff_url for PRs, report_url for non-PR scans
-        view_report_url = ""
-        if hasattr(diff, 'diff_url') and diff.diff_url:
-            view_report_url = diff.diff_url
-        elif hasattr(diff, 'report_url') and diff.report_url:
-            view_report_url = diff.report_url
-            
         comment += f"""
   </tbody>
 </table>
@@ -959,7 +1043,7 @@ class Messages:
 [View full report]({view_report_url}?action=error%2Cwarn)
     """
 
-        return comment
+        return Messages.normalize_comment_html(comment)
 
     @staticmethod
     def get_severity_icon(severity: str) -> str:

{socketsecurity-2.6.11 → socketsecurity-2.7.1}/socketsecurity/core/scm_comments.py

@@ -1,12 +1,16 @@
 import json
+import re
 
 from requests import Response
 
 from socketsecurity.core import log
 from socketsecurity.core.classes import Comment, Issue
+from socketsecurity.core.messages import Messages
 
 
 class Comments:
+    VIEW_REPORT_PATTERN = re.compile(r"\[View full report\]\(([^)\s]+)\)")
+
     @staticmethod
     def process_response(response: Response) -> dict:
         output = {}
@@ -84,6 +88,20 @@ class Comments:
             is_heading_line = False
         return is_heading_line
 
+    @staticmethod
+    def extract_report_url(body: str) -> str:
+        """
+        Pulls the Socket report link out of an existing comment body so it can be
+        carried over when the comment is rewritten.
+
+        :param body: str - The existing comment body.
+        :return: str - The report URL without its query string, or "" if absent.
+        """
+        match = Comments.VIEW_REPORT_PATTERN.search(body)
+        if not match:
+            return ""
+        return match.group(1).split("?", 1)[0]
+
     @staticmethod
     def process_security_comment(comment: Comment, comments) -> str:
         ignore_all, ignore_commands = Comments.get_ignore_options(comments)
@@ -102,6 +120,7 @@ class Comments:
     ) -> str:
         start = False
         lines = []
+        kept_alert = False
         for line in comment.body_list:
             line = line.strip()
             if "start-socket-alerts-table" in line:
@@ -114,17 +133,25 @@ class Comments:
                 ecosystem = ecosystem.lstrip("[")
                 pkg_name, pkg_version = details.split("@")
                 pkg_name = f"{ecosystem}/{pkg_name}"
-                ignore = False
-                for name, version in ignore_commands:
-                    if ignore_all or Comments.is_ignore(pkg_name, pkg_version, name, version):
-                        ignore = True
+                # ignore_all has to be checked outside the loop: an ignore-all
+                # comment produces no ignore_commands, so a loop-internal check
+                # never runs and every row was kept.
+                ignore = ignore_all or any(
+                    Comments.is_ignore(pkg_name, pkg_version, name, version)
+                    for name, version in ignore_commands
+                )
                 if not ignore:
+                    kept_alert = True
                     lines.append(line)
             elif "end-socket-alerts-table" in line:
                 start = False
                 lines.append(line)
             else:
                 lines.append(line)
+        if not kept_alert:
+            return Messages.security_comment_no_alerts_template(
+                Comments.extract_report_url("\n".join(comment.body_list))
+            )
         return "\n".join(lines)
 
     @staticmethod
@@ -145,17 +172,21 @@ class Comments:
         """
         lines = []
         ignore_section = False
+        kept_alert = False  # Whether any alert row survived the ignore commands
         pkg_name = pkg_version = ""  # Track current package and version
 
         # Loop through the comment lines
         for line in comment.body_list:
-            line = line.strip()
+            # Match on the stripped line but keep the original, so the markup is
+            # rewritten with the same indentation it was generated with.
+            line = line.rstrip("\r")
+            stripped = line.strip()
 
             # Detect the start of an alert section
-            if line.startswith("<!-- start-socket-alert-"):
+            if stripped.startswith("<!-- start-socket-alert-"):
                 # Extract package name and version from the comment
                 try:
-                    start_marker = line[len("<!-- start-socket-alert-"):-4]  # Strip the comment markers
+                    start_marker = stripped[len("<!-- start-socket-alert-"):-4]  # Strip the comment markers
                     pkg_name, pkg_version = start_marker.split("@")  # Extract pkg_name and pkg_version
                 except ValueError:
                     pkg_name, pkg_version = "", ""
@@ -168,10 +199,11 @@ class Comments:
 
                 # If not ignored, include this start marker
                 if not ignore_section:
+                    kept_alert = True
                     lines.append(line)
 
             # Detect the end of an alert section
-            elif line.startswith("<!-- end-socket-alert-"):
+            elif stripped.startswith("<!-- end-socket-alert-"):
                 # Only include if we are not ignoring this section
                 if not ignore_section:
                     lines.append(line)
@@ -181,7 +213,14 @@ class Comments:
             elif not ignore_section:
                 lines.append(line)
 
-        return "\n".join(lines)
+        # Every row was ignored, so drop the table rather than leaving the caution
+        # banner sitting above an empty one.
+        if not kept_alert:
+            return Messages.security_comment_no_alerts_template(
+                Comments.extract_report_url("\n".join(comment.body_list))
+            )
+
+        return Messages.normalize_comment_html("\n".join(lines))
 
     @staticmethod
     def extract_alert_details_from_row(row: str, ignore_all: bool, ignore_commands: list[tuple[str, str]]) -> tuple: