socketsecurity 2.9.7__tar.gz → 2.10.0__tar.gz

{socketsecurity-2.9.7 → socketsecurity-2.10.0}/CHANGELOG.md

@@ -1,5 +1,32 @@
 # Changelog
 
+## 2.10.0
+
+### Fixed
+
+- `--base-commit-sha` now sets the range changed-file detection reads, so a manifest
+  changed anywhere between that commit and HEAD triggers a comparison. Previously only
+  a recognized GitHub, GitLab, Bitbucket, or Buildkite pull request read a full range,
+  and every other run saw the current commit alone.
+- A base commit that cannot be resolved in the checkout now warns instead of narrowing
+  the comparison to a single commit.
+- A full scan reports its findings as repository findings rather than new ones, and
+  labels its link `Report Url`. The summary states why the counts do not affect the
+  exit code.
+- Removed and replaced packages with a namespace no longer render a duplicated purl in
+  the dependency overview comment.
+
+- The 200-character cap on the commit message now applies to the value read from the
+  repository, not only to `--commit-message`. A truncated message ends in `...` and the
+  truncation is reported at INFO.
+- A full scan refused for its size (HTTP 413, 414 or 431) now distinguishes possible
+  upload-size and request-metadata causes and reports what to shorten.
+
+### Changed
+
+- `--ignore-commit-files` is documented as forcing a comparison, which is what it does.
+  The CLI reference and `--help` described it as forcing a full scan.
+
 ## 2.9.7
 
 ### Changed: bump pinned @coana-tech/cli to 15.10.51

{socketsecurity-2.9.7 → socketsecurity-2.10.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: socketsecurity
-Version: 2.9.7
+Version: 2.10.0
 Summary: Socket Security CLI for CI/CD
 Project-URL: Homepage, https://socket.dev
 Author-email: Douglas Coburn <douglas@socket.dev>

{socketsecurity-2.9.7 → socketsecurity-2.10.0}/docs/cli-reference.md

@@ -256,7 +256,7 @@ If you don't want to provide the Socket API Token every time then you can use th
 | `--commit-message` | False    | *auto*  | Commit message (auto-detected from git)       |
 | `--commit-sha`     | False    | *auto*  | Commit SHA (auto-detected from git)           |
 | `--base-scan-id`   | False    |         | Full scan ID to diff against, overriding the repository's head scan as the baseline. Mutually exclusive with `--base-commit-sha` |
-| `--base-commit-sha`| False    |         | Commit SHA to prefer as the diff baseline, overriding the repository's head scan. The CLI uses its most recent matching full scan or the nearest scanned first-parent ancestor within 100 local commits. It errors (exit code 3, or `--exit-code-on-api-error`) if no scanned ancestor is reachable. Mutually exclusive with `--base-scan-id` |
+| `--base-commit-sha`| False    |         | Commit SHA to prefer as the diff baseline, overriding the repository's head scan. The CLI uses its most recent matching full scan or the nearest scanned first-parent ancestor within 100 local commits. It errors (exit code 3, or `--exit-code-on-api-error`) if no scanned ancestor is reachable. Also sets the range changed-file detection reads, so a manifest changed anywhere between this commit and HEAD is seen. Mutually exclusive with `--base-scan-id` |
 
 > **Diffing against the merge base** — by default, PR scans are diffed against the repository's latest matching head scan, which may include newer default-branch commits than your PR branched from. To prefer the commit your PR is based on, compute the merge base and pass it as the baseline:
 >
@@ -267,6 +267,8 @@ If you don't want to provide the Socket API Token every time then you can use th
 >
 > `--base-commit-sha` does not create a scan of that commit. The CLI first looks for the newest non-temporary scan matching the repository, workspace, scan type, and exact commit. If the exact commit was not scanned, it walks up to 100 first-parent commits from that SHA in the local checkout and uses the nearest matching scanned ancestor. It logs a warning with the selected commit and distance because this produces a wider diff than the merge base.
 >
+> Supplying `--base-commit-sha` also widens the range the CLI reads when deciding whether any manifest changed. Without it, and outside a recognized CI pull request or merge request, the CLI sees only the current commit, so a pull request whose manifest changed in an earlier commit is treated as a source-only change and the comparison is skipped. If the base commit cannot be resolved in the local checkout, the CLI warns and falls back to the current commit alone; deepen the clone or fetch the base commit to compare the full range.
+>
 > Run `socketcli` regularly on the default branch so recent ancestors have scans. PR checkouts must also retain the merge base and enough first-parent history; shallow clones can shorten the search. Gaps are expected when CI cancels intermediate builds, commits use `[skip ci]`, pipelines are path-filtered, or the merge base predates your Socket rollout.
 >
 > If no scanned ancestor is reachable within the local 100-commit walk, the CLI **fails** (exit code 3, or your `--exit-code-on-api-error` value; exit 0 with `--disable-blocking`) instead of silently falling back to the repository head. API or permission failures also fail rather than being treated as a missing exact scan.
@@ -427,7 +429,7 @@ The launcher can be tuned via the `SOCKET_CLI_COANA_LAUNCHER` environment variab
 #### Advanced Configuration
 | Parameter                | Required | Default | Description                                                           |
 |:-------------------------|:---------|:--------|:----------------------------------------------------------------------|
-| `--ignore-commit-files`    | False    | False   | Ignore commit files                                                   |
+| `--ignore-commit-files`    | False    | False   | Compare regardless of which files changed, scanning every manifest    |
 | `--disable-blocking`       | False    | False   | Non-blocking CI mode: the CLI always exits **0**, even when blocking alerts are present (including with `--strict-blocking`). Also exits 0 on uncaught runtime errors and Socket API failures, so the job is treated as successful while findings and errors are still logged. Takes precedence over `--strict-blocking`. |
 | `--disable-ignore`         | False    | False   | Disable support for `@SocketSecurity ignore` commands in PR comments. When set, alerts cannot be suppressed via comments and ignore instructions are hidden from comment output. See [Who can ignore an alert](#who-can-ignore-an-alert). |
 | `--ignore-authorization`   | False    | enforce | Who may suppress alerts with `@SocketSecurity ignore`. `enforce` requires write access and honors the command with a warning when the provider cannot report it; `strict` rejects it in that case; `off` honors any commenter. See [Who can ignore an alert](#who-can-ignore-an-alert). |
@@ -674,10 +676,10 @@ The CLI now automatically detects repository information from your git environme
 - **Commit message**: Latest commit message
 - **Committer information**: Git commit author details
 - **Default branch status**: Determined from git repository and CI environment
-- **Changed files**: Files modified in the current commit (for differential scanning)
+- **Changed files**: Files modified in the current commit, or across the whole `--base-commit-sha`..HEAD range when a base commit is supplied (for differential scanning)
 > **Note on merge commits**:  
 > Standard merges (two parents) are supported.  
-> For *octopus merges* (three or more parents), Git only reports changes relative to the first parent. This can lead to incomplete or empty file lists if changes only exist relative to other parents. In these cases, differential scanning may be skipped. To ensure coverage, use `--ignore-commit-files` to force a full scan or specify files explicitly with `--files`.
+> For *octopus merges* (three or more parents), Git only reports changes relative to the first parent. This can lead to incomplete or empty file lists if changes only exist relative to other parents. In these cases, differential scanning may be skipped. To ensure coverage, use `--ignore-commit-files` to compare regardless of the detected changes, or specify files explicitly with `--files`.
 ### Default Branch Detection
 
 The CLI uses intelligent default branch detection with the following priority:
@@ -728,11 +730,11 @@ GitLab token/auth behavior and CI examples are documented in [`ci-cd.md`](ci-cd.
 
 The CLI determines which files to scan based on the following logic:
 
-1. **Git Commit Files (Default)**: The CLI automatically checks files changed in the current git commit. If any of these files match supported manifest patterns (like package.json, requirements.txt, etc.), a scan is triggered.
+1. **Git Commit Files (Default)**: The CLI automatically checks which files changed. In a recognized CI pull request or merge request, and whenever `--base-commit-sha` is supplied, that is every file changed across the range; otherwise it is the current commit alone. If any of them match supported manifest patterns (like package.json, requirements.txt, etc.), a comparison is run.
 
 2. **`--files` Parameter Override**: When specified, this parameter takes precedence over git commit detection. It accepts a JSON array of file paths to check for manifest files.
 
-3. **`--ignore-commit-files` Flag**: When set, git commit files are ignored completely, and the CLI will scan all manifest files in the target directory regardless of what changed.
+3. **`--ignore-commit-files` Flag**: When set, the changed-file check is skipped entirely. The CLI runs the comparison regardless of what changed, and scans every manifest file in the target directory.
 
 4. **Automatic Fallback**: If no manifest files are found in git commit changes and no `--files` are specified, the CLI automatically switches to "API mode" and performs a full repository scan.
 
@@ -742,7 +744,7 @@ The CLI determines which files to scan based on the following logic:
 
 - **Differential Mode**: When manifest files are detected in changes, performs a diff scan with PR/MR comment integration
 - **API Mode**: When no manifest files are in changes, creates a full scan report without PR comments but still scans the entire repository
-- **Force Mode**: With `--ignore-commit-files`, always performs a full scan regardless of changes
+- **Force Mode**: With `--ignore-commit-files`, always runs a comparison regardless of which files changed, over every manifest in the target path
 - **Forced Diff Mode**: With `--enable-diff`, forces differential mode even when using `--integration api` (without SCM integration)
 
 ### Examples
@@ -750,7 +752,7 @@ The CLI determines which files to scan based on the following logic:
 - **Commit with manifest file**: If your commit includes changes to `package.json`, a differential scan will be triggered automatically with PR comment integration.
 - **Commit without manifest files**: If your commit only changes non-manifest files (like `.github/workflows/socket.yaml`), the CLI automatically switches to API mode and performs a full repository scan.
 - **Using `--files`**: If you specify `--files '["package.json"]'`, the CLI will check if this file exists and is a manifest file before determining scan type.
-- **Using `--ignore-commit-files`**: This forces a full scan of all manifest files in the target path, regardless of what's in your commit.
+- **Using `--ignore-commit-files`**: This runs the comparison regardless of what's in your commit, over all manifest files in the target path. Use it when the changed-file check would otherwise skip a comparison you need.
 - **Using `--enable-diff`**: Forces diff mode without SCM integration - useful when you want differential scanning but are using `--integration api`. For example: `socketcli --integration api --enable-diff --target-path /path/to/repo`
 - **Auto-detection**: Most CI/CD scenarios now work with just `socketcli --target-path /path/to/repo --scm github --pr-number $PR_NUM`
 

{socketsecurity-2.9.7 → socketsecurity-2.10.0}/pyproject.toml

@@ -6,7 +6,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "socketsecurity"
-version = "2.9.7"
+version = "2.10.0"
 requires-python = ">= 3.11"
 license = {"file" = "LICENSE"}
 dependencies = [

{socketsecurity-2.9.7 → socketsecurity-2.10.0}/socketsecurity/__init__.py

@@ -1,3 +1,3 @@
 __author__ = 'socket.dev'
-__version__ = '2.9.7'
+__version__ = '2.10.0'
 USER_AGENT = f'SocketPythonCLI/{__version__}'

{socketsecurity-2.9.7 → socketsecurity-2.10.0}/socketsecurity/config.py

@@ -19,6 +19,32 @@ def get_plugin_config_from_env(prefix: str) -> dict:
         return {}
 
 
+# commit_message rides in the query string of POST /v0/orgs/{org}/full-scans, so an
+# oversized message overflows the edge proxy's request line limit before the API ever
+# sees it. The API itself has no length validation on the field; the rejection comes
+# from the proxy, which reports 413, 414 or 431 depending on which limit it checks. 200
+# chars is a conservative ceiling given URL encoding can 2-3x the raw character count.
+MAX_COMMIT_MESSAGE_LENGTH = 200
+
+
+COMMIT_MESSAGE_TRUNCATION_MARKER = "..."
+
+
+def truncate_commit_message(commit_message: Optional[str]) -> Optional[str]:
+    """Cap commit_message to a length the full-scan request line can carry."""
+    if commit_message and len(commit_message) > MAX_COMMIT_MESSAGE_LENGTH:
+        # INFO, not DEBUG: the scan keeps the truncated value, so for a CI job that does
+        # not pass --enable-debug this line is the only explanation of why the message in
+        # the dashboard is clipped.
+        logging.info(
+            f"commit_message truncated from {len(commit_message)} to "
+            f"{MAX_COMMIT_MESSAGE_LENGTH} characters to stay within API request size limits"
+        )
+        keep = MAX_COMMIT_MESSAGE_LENGTH - len(COMMIT_MESSAGE_TRUNCATION_MARKER)
+        return commit_message[:keep] + COMMIT_MESSAGE_TRUNCATION_MARKER
+    return commit_message
+
+
 def load_cli_config_file(config_path: str) -> dict:
     """
     Load CLI defaults from a JSON or TOML file.
@@ -201,7 +227,13 @@ class CliConfig:
     legal: bool = False
     legal_format: str = "socket"
     config_file: Optional[str] = None
-    
+
+    def __post_init__(self):
+        # Capped on construction so that every source of commit_message -- the
+        # --commit-message flag, a config file, the git backfill in socketcli -- lands
+        # under the limit.
+        self.commit_message = truncate_commit_message(self.commit_message)
+
     @classmethod
     def from_args(cls, args_list: Optional[List[str]] = None) -> 'CliConfig':
         parser = create_argument_parser()
@@ -257,19 +289,6 @@ class CliConfig:
         if commit_message and commit_message.startswith('"') and commit_message.endswith('"'):
             commit_message = commit_message[1:-1]
 
-        # Truncate to avoid 413s from oversized URL query parameters.
-        # The API has no application-layer length validation on commit_message;
-        # the 413 originates from an infrastructure-layer URL length limit
-        # (nginx/Cloudflare). 200 chars chosen as a conservative ceiling given
-        # URL encoding can 2-3x raw character count.
-        MAX_COMMIT_MESSAGE_LENGTH = 200
-        if commit_message and len(commit_message) > MAX_COMMIT_MESSAGE_LENGTH:
-            logging.debug(
-                f"commit_message truncated from {len(commit_message)} to "
-                f"{MAX_COMMIT_MESSAGE_LENGTH} characters to avoid API request size limits"
-            )
-            commit_message = commit_message[:MAX_COMMIT_MESSAGE_LENGTH]
-
         config_args = {
             'api_token': api_token,
             'repo': args.repo,
@@ -612,7 +631,9 @@ def create_argument_parser() -> argparse.ArgumentParser:
         help="Commit SHA to diff the new scan against, overriding the repository's head "
              "scan as the baseline. The CLI uses the most recent matching full scan, or "
              "the nearest scanned first-parent ancestor within 100 local commits when "
-             "the commit itself was not scanned. Mutually exclusive with --base-scan-id."
+             "the commit itself was not scanned. Also sets the range changed-file "
+             "detection reads, so a manifest changed anywhere between this commit and "
+             "HEAD is seen. Mutually exclusive with --base-scan-id."
     )
 
     # Path and File options
@@ -913,7 +934,7 @@ def create_argument_parser() -> argparse.ArgumentParser:
         "--ignore-commit-files",
         dest="ignore_commit_files",
         action="store_true",
-        help="Ignore commit files"
+        help="Compare against the baseline regardless of which files changed, scanning every manifest in the target path"
     )
     advanced_group.add_argument(
         "--ignore_commit_files",

{socketsecurity-2.9.7 → socketsecurity-2.10.0}/socketsecurity/core/__init__.py

@@ -113,6 +113,12 @@ FULL_SCAN_UPLOAD_BACKOFF_SCHEDULE_SECONDS = (10.0, 30.0, None)
 FULL_SCAN_UPLOAD_MAX_ATTEMPTS = len(FULL_SCAN_UPLOAD_BACKOFF_SCHEDULE_SECONDS)
 FULL_SCAN_UPLOAD_BACKOFF_JITTER_SECONDS = 2.0
 
+# Statuses that mean the request is too large to process. Scan metadata travels in the
+# query string of the full-scan POST, while manifests travel in its multipart body. A
+# 413 can refer to either part; 414 points to the URL, and some proxies report 431 when
+# the encoded request target exceeds their header limit. None are transient.
+REQUEST_TOO_LARGE_STATUS_CODES = (413, 414, 431)
+
 # Diff-scan polling policy. The legacy scan comparison (fullscans.stream_diff) holds a
 # single HTTP connection open, fully idle, while the backend computes the diff; network
 # middleboxes with TCP idle timeouts (notably Azure NAT gateways, which default to
@@ -1118,6 +1124,23 @@ class Core:
                     res = self.sdk.fullscans.post(upload_files, params, use_types=True, use_lazy_loading=True, max_open_files=50, base_paths=base_paths)
                     break
                 except APIFailure as error:
+                    if error.status_code in REQUEST_TOO_LARGE_STATUS_CODES:
+                        if error.status_code == 413:
+                            guidance = (
+                                "The response does not distinguish between an oversized multipart "
+                                "upload and oversized scan metadata in the request URL. Reduce the "
+                                "uploaded scan inputs, or pass a shorter --commit-message."
+                            )
+                        else:
+                            guidance = (
+                                "Scan metadata is sent in the request URL. Pass a shorter "
+                                "--commit-message or shorten other scan metadata."
+                            )
+                        raise APIFailure(
+                            f"Full scan request rejected as too large (HTTP {error.status_code}). "
+                            f"{guidance}\n{error}",
+                            status_code=error.status_code,
+                        ) from error
                     if backoff_seconds is None or not error.is_transient_error():
                         raise
                     wait_seconds = backoff_seconds + random.uniform(
@@ -2267,8 +2290,6 @@ class Core:
             try:
                 pkg = Package.from_diff_artifact(asdict(artifact))
                 pkg = Core.update_package_values(pkg)
-                if pkg.namespace:
-                    pkg.purl += f"{pkg.namespace}/{pkg.purl}"
                 removed_packages[artifact.id] = pkg
             except KeyError:
                 log.error(f"KeyError: Could not create package from removed artifact {artifact.id}")

{socketsecurity-2.9.7 → socketsecurity-2.10.0}/socketsecurity/core/git_interface.py

@@ -11,10 +11,21 @@ from socketsecurity.core import log
 class Git:
     repo: Repo
     path: str
+    base_commit_sha: str | None
 
-    def __init__(self, path: str):
+    def __init__(self, path: str, base_commit_sha: str | None = None):
+        """
+        Reads the repository state a scan is built from.
+
+        Args:
+            path: Path to the repository working tree
+            base_commit_sha: Commit the comparison should start from. Supplied when
+                the caller knows the range and no CI environment describes it, which
+                is the only way changed-file detection can see commits behind HEAD.
+        """
         initialization_start = time.perf_counter()
         self.path = path
+        self.base_commit_sha = base_commit_sha
         self._fetched_ref_commits = {}
         self.ensure_safe_directory(path)
         self.repo = Repo(path)
@@ -164,40 +175,62 @@ class Git:
         buildkite_pr = os.getenv('BUILDKITE_PULL_REQUEST')
         buildkite_base_ref = os.getenv('BUILDKITE_PULL_REQUEST_BASE_BRANCH')
         buildkite_head_ref = os.getenv('BUILDKITE_BRANCH')
-        if self._is_buildkite_pull_request(buildkite_pr) and buildkite_base_ref:
-            detected = self._detect_pull_request_changes(
-                provider="Buildkite",
-                base_ref=buildkite_base_ref,
-                head_ref=buildkite_head_ref,
-            )
-            if detected:
-                detection_source = "buildkite-pr"
-        elif github_event_name == 'pull_request' and github_base_ref:
+
+        # An explicitly supplied base commit states the comparison range outright,
+        # so it is honored before any inference from CI environment variables.
+        if self.base_commit_sha:
             detected = self._detect_pull_request_changes(
-                provider="GitHub",
-                base_ref=github_base_ref,
-                head_ref=github_head_ref,
+                provider="explicit base commit",
+                base_ref=self.base_commit_sha,
+                head_ref=None,
+                use_merge_base=False,
             )
             if detected:
-                detection_source = "github-pr"
-        # Commits to default branch (push events)
-        elif github_event_name == 'push' and github_before_sha and github_sha:
-            try:
-                diff_files = self.repo.git.diff('--name-only', f'{github_before_sha}..{github_sha}')
-                self.show_files = diff_files.splitlines()
-                log.debug(f"Changed files detected via git diff (GitHub push): {self.show_files}")
-                detected = True
-                detection_source = "github-push"
-            except Exception as error:
-                log.debug(f"Failed to get changed files via git diff (GitHub push): {error}")
-        elif github_event_name == 'push':
-            try:
-                self.show_files = self.repo.git.show(self.commit, name_only=True, format="%n").splitlines()
-                log.debug(f"Changed files detected via git show (GitHub push fallback): {self.show_files}")
-                detected = True
-                detection_source = "github-push-fallback"
-            except Exception as error:
-                log.debug(f"Failed to get changed files via git show (GitHub push fallback): {error}")
+                detection_source = "explicit-base-commit"
+            else:
+                log.warning(
+                    f"Could not resolve base commit {self.base_commit_sha} in this "
+                    "checkout, so changed-file detection falls back to the current "
+                    "commit alone. A manifest changed earlier in the range will not "
+                    "be seen, which can skip the comparison entirely. Deepen the "
+                    "clone or fetch the base commit to compare the full range."
+                )
+
+        if not detected:
+            if self._is_buildkite_pull_request(buildkite_pr) and buildkite_base_ref:
+                detected = self._detect_pull_request_changes(
+                    provider="Buildkite",
+                    base_ref=buildkite_base_ref,
+                    head_ref=buildkite_head_ref,
+                )
+                if detected:
+                    detection_source = "buildkite-pr"
+            elif github_event_name == 'pull_request' and github_base_ref:
+                detected = self._detect_pull_request_changes(
+                    provider="GitHub",
+                    base_ref=github_base_ref,
+                    head_ref=github_head_ref,
+                )
+                if detected:
+                    detection_source = "github-pr"
+            # Commits to default branch (push events)
+            elif github_event_name == 'push' and github_before_sha and github_sha:
+                try:
+                    diff_files = self.repo.git.diff('--name-only', f'{github_before_sha}..{github_sha}')
+                    self.show_files = diff_files.splitlines()
+                    log.debug(f"Changed files detected via git diff (GitHub push): {self.show_files}")
+                    detected = True
+                    detection_source = "github-push"
+                except Exception as error:
+                    log.debug(f"Failed to get changed files via git diff (GitHub push): {error}")
+            elif github_event_name == 'push':
+                try:
+                    self.show_files = self.repo.git.show(self.commit, name_only=True, format="%n").splitlines()
+                    log.debug(f"Changed files detected via git show (GitHub push fallback): {self.show_files}")
+                    detected = True
+                    detection_source = "github-push-fallback"
+                except Exception as error:
+                    log.debug(f"Failed to get changed files via git show (GitHub push fallback): {error}")
         # GitLab CI Merge Request context
         if not detected:
             gitlab_target = os.getenv('CI_MERGE_REQUEST_TARGET_BRANCH_NAME')
@@ -316,8 +349,9 @@ class Git:
             provider: str,
             base_ref: str,
             head_ref: str | None,
+            use_merge_base: bool = True,
     ) -> bool:
-        """Detect a full PR range locally, fetching only refs needed to complete it."""
+        """Detect a base-to-head range locally, fetching only refs needed to complete it."""
         base_commit = self._resolve_ref(base_ref)
         if base_commit is None:
             base_commit = self._fetch_ref(base_ref, f"{provider} pull-request base ref missing")
@@ -326,7 +360,8 @@ class Git:
             return False
 
         head_commit = self.commit.hexsha
-        diff_range = f"{base_commit}...{head_commit}"
+        range_separator = "..." if use_merge_base else ".."
+        diff_range = f"{base_commit}{range_separator}{head_commit}"
         try:
             diff_files = self.repo.git.diff("--name-only", diff_range)
             self.show_files = diff_files.splitlines()
@@ -352,7 +387,7 @@ class Git:
         try:
             diff_files = self.repo.git.diff(
                 "--name-only",
-                f"{base_commit}...{head_commit}",
+                f"{base_commit}{range_separator}{head_commit}",
             )
             self.show_files = diff_files.splitlines()
             log.debug(

{socketsecurity-2.9.7 → socketsecurity-2.10.0}/socketsecurity/output.py

@@ -229,10 +229,8 @@ class OutputHandler:
 
     def build_summary_text(self, diff_report: Diff) -> str:
         """Render the console summary text for stdout and file output."""
-        if (
-            getattr(diff_report, "is_full_scan", False)
-            and not getattr(diff_report, "alerts_fetched", False)
-        ):
+        is_full_scan = getattr(diff_report, "is_full_scan", False)
+        if is_full_scan and not getattr(diff_report, "alerts_fetched", False):
             lines = ["Full scan completed. Findings were not fetched for console output."]
             report_link = getattr(diff_report, "report_url", "") or getattr(
                 diff_report, "diff_url", ""
@@ -264,20 +262,33 @@ class OutputHandler:
         selected_diff = clone_diff_with_selected_alerts(diff_report, selected_alerts)
         console_security_comment = Messages.create_console_security_alert_table(selected_diff)
 
+        # A full scan has no baseline, so everything it carries is a finding in the
+        # repository rather than one the change introduced. Calling those NEW would
+        # also contradict the exit code, which stays 0 because no finding can be
+        # attributed to the change.
+        blocking_label = "Blocking issues" if is_full_scan else "NEW blocking issues"
+        warning_label = "Warning issues" if is_full_scan else "NEW warning issues"
+        link_label = "Report Url" if is_full_scan else "Diff Url"
+
         lines = ["Security issues detected by Socket Security:"]
         if new_blocking > 0:
-            lines.append(f"  - NEW blocking issues: {new_blocking}")
+            lines.append(f"  - {blocking_label}: {new_blocking}")
         if new_warning > 0:
-            lines.append(f"  - NEW warning issues: {new_warning}")
+            lines.append(f"  - {warning_label}: {new_warning}")
         if unchanged_blocking > 0:
             lines.append(
                 f"  - EXISTING blocking issues: {unchanged_blocking} (causing failure due to --strict-blocking)"
             )
         if unchanged_warning > 0:
             lines.append(f"  - EXISTING warning issues: {unchanged_warning}")
+        if is_full_scan:
+            lines.append(
+                "  Reported against the whole repository, with no baseline to compare "
+                "against, so these do not affect the exit code."
+            )
 
         report_link = getattr(diff_report, "report_url", "") or getattr(diff_report, "diff_url", "")
-        lines.append(f"Diff Url: {report_link}")
+        lines.append(f"{link_label}: {report_link}")
         lines.append("")
         lines.append(str(console_security_comment))
         return "\n".join(lines)

{socketsecurity-2.9.7 → socketsecurity-2.10.0}/socketsecurity/socketcli.py

@@ -12,7 +12,7 @@ from git import InvalidGitRepositoryError, NoSuchPathError
 from socketdev import socketdev
 from socketdev.fullscans import FullScanParams
 
-from socketsecurity.config import CliConfig
+from socketsecurity.config import CliConfig, truncate_commit_message
 from socketsecurity.core import Core
 from socketsecurity.core.classes import Diff
 from socketsecurity.core.cli_client import CliClient
@@ -210,6 +210,35 @@ def create_scm_scan(
     return diff, False
 
 
+def apply_git_context(config: CliConfig) -> Tuple[bool, Optional[Git]]:
+    """
+    Fill in any repo details the caller did not pass from the checkout at target_path.
+
+    Returns whether target_path is a git repository, along with the Git handle when it is.
+    """
+    try:
+        git_repo = Git(config.target_path, base_commit_sha=config.base_commit_sha)
+    except InvalidGitRepositoryError:
+        log.debug("Not a git repository, setting ignore_commit_files=True")
+        config.ignore_commit_files = True
+        return False, None
+    except NoSuchPathError:
+        raise Exception(f"Unable to find path {config.target_path}")
+
+    if not config.repo:
+        config.repo = git_repo.repo_name
+    if not config.commit_sha:
+        config.commit_sha = git_repo.commit_str
+    if not config.branch:
+        config.branch = git_repo.branch
+    if not config.committers:
+        config.committers = [git_repo.get_formatted_committer()]
+    if not config.commit_message:
+        # A repository's commit message is unbounded and ships in the query string.
+        config.commit_message = truncate_commit_message(git_repo.commit_message)
+    return True, git_repo
+
+
 def build_socket_sdk(config: CliConfig) -> socketdev:
     cli_user_agent_string = f"SocketPythonCLI/{config.version}"
     return socketdev(
@@ -402,27 +431,7 @@ def main_code():
         discovered_scan_files = None
         
         # Git setup
-        is_repo = False
-        git_repo: Git
-        try:
-            git_repo = Git(config.target_path)
-            is_repo = True
-            if not config.repo:
-                config.repo = git_repo.repo_name
-            if not config.commit_sha:
-                config.commit_sha = git_repo.commit_str
-            if not config.branch:
-                config.branch = git_repo.branch
-            if not config.committers:
-                config.committers = [git_repo.get_formatted_committer()]
-            if not config.commit_message:
-                config.commit_message = git_repo.commit_message
-        except InvalidGitRepositoryError:
-            is_repo = False
-            log.debug("Not a git repository, setting ignore_commit_files=True")
-            config.ignore_commit_files = True
-        except NoSuchPathError:
-            raise Exception(f"Unable to find path {config.target_path}")
+        is_repo, git_repo = apply_git_context(config)
 
         # Track whether repo/branch fell back to the default sentinels so reachability can skip
         # forwarding them as coana cache-bucket keys (computed before any workspace suffixing).

{socketsecurity-2.9.7 → socketsecurity-2.10.0}/tests/core/test_diff_generation.py

@@ -3,7 +3,7 @@ from dataclasses import asdict, fields
 from pathlib import Path
 
 import pytest
-from socketdev.fullscans import DiffArtifact
+from socketdev.fullscans import DiffArtifact, StreamDiffResponse
 
 from socketsecurity.core import Core
 from socketsecurity.core.classes import Package
@@ -312,3 +312,48 @@ def print_added_and_removed(added, removed):
     #     pkg1_purl = next(p for p in diff.new_packages if p.id == "pkg1")
     #     assert hasattr(pkg1_purl, "capabilities")
     #     assert set(pkg1_purl.capabilities) == {"File System Access", "Network Access"}
+
+
+def _namespaced_diff_response(namespace: str = "com.example"):
+    """One namespaced artifact, delivered as both an addition and a removal."""
+    raw = json.loads(
+        (Path(__file__).parent.parent / "data/fullscans/diff/stream_diff.json").read_text()
+    )
+    template = raw["data"]["artifacts"]["added"][0]
+    artifacts = {bucket: [] for bucket in ("added", "removed", "unchanged", "replaced", "updated")}
+    for bucket in ("added", "removed"):
+        artifacts[bucket].append(
+            dict(
+                template,
+                diffType=bucket,
+                head=None,
+                base=None,
+                id=f"namespaced-{bucket}",
+                namespace=namespace,
+                name="widget",
+                version="1.0.0",
+                type="maven",
+            )
+        )
+    return StreamDiffResponse.from_dict({
+        "success": raw["success"],
+        "status": raw["status"],
+        "data": {**raw["data"], "artifacts": artifacts},
+    })
+
+
+def test_removed_package_purl_matches_the_added_form(core):
+    """A namespace belongs in the purl once, whichever bucket the artifact arrives in.
+
+    The purl reaches the dependency overview comment verbatim, so a second copy of
+    the namespace renders as an unreadable package name on every removed or
+    replaced row.
+    """
+    core.sdk.fullscans.stream_diff.side_effect = None
+    core.sdk.fullscans.stream_diff.return_value = _namespaced_diff_response()
+    core.sdk.diffscans.create_from_ids.side_effect = Exception("diff-scans unavailable")
+
+    added, removed, _ = core.get_added_and_removed_packages("head", "new")
+
+    assert added["namespaced-added"].purl == "com.example/widget@1.0.0"
+    assert removed["namespaced-removed"].purl == added["namespaced-added"].purl

{socketsecurity-2.9.7 → socketsecurity-2.10.0}/tests/unit/test_cli_config.py

@@ -31,14 +31,15 @@ class TestCommitMessageTruncation:
         config = CliConfig.from_args(
             ["--api-token", "test", "--commit-message", "a" * 250]
         )
-        assert config.commit_message == "a" * 200
+        assert config.commit_message == "a" * 197 + "..."
+        assert len(config.commit_message) == 200
 
     def test_quote_strip_runs_before_truncation(self):
         quoted = '"' + ("b" * 250) + '"'
         config = CliConfig.from_args(
             ["--api-token", "test", "--commit-message", quoted]
         )
-        assert config.commit_message == "b" * 200
+        assert config.commit_message == "b" * 197 + "..."
 
 
 class TestCliConfig: