Don't render .socket.facts.json placeholder as blocking package - #321
Merged
lelia merged 1 commit intoSep 2, 2026
Merged
Conversation
Copy link
Copy Markdown
Contributor
Sorry, something went wrong.
Copy link
Copy Markdown
|
🐳 Docker preview published: socketdev/cli:pr-321 This mutable tag is only created when a Docker preview is explicitly requested. |
Sorry, something went wrong.
Copy link
Copy Markdown
|
🚀 CLI preview published: socketsecurity==2.6.9.dev3312870820701 pip install --index-url https://test.pypi.org/simple/ --extra-index-url https://pypi.org/simple socketsecurity==2.6.9.dev3312870820701TestPyPI's package index can take several minutes to expose a newly uploaded version. |
Sorry, something went wrong.
Comment thread
socketsecurity/core/__init__.py
Outdated
Eric Hibbs (flowstate)
approved these changes
Aug 28, 2026
Eric Hibbs (flowstate)
left a comment
Copy link
Copy Markdown
Contributor
There was a problem hiding this comment.
See my note about comment nits, but the important stuff lgtm
Sorry, something went wrong.
lelia
force-pushed
the
lelia/ce-422-python-cli-treats-invalid-socketfactsjson-error-as-blocking
branch
from
01b89e4 to
7e3c634
Compare
September 2, 2026 20:23
Scans with no supported manifest files uploaded a zero-byte `.socket.facts.json` placeholder. The API cannot parse that and responds by adding a synthetic `generic/invalid-socket-facts@1.0.0` artifact, which the CLI then reported as a new blocking package with no manifest file and no introducing dependency, failing the run and posting a pull request comment that could not be acted on. - Write an empty but well-formed facts document as the placeholder. - Give each placeholder its own temp directory, so concurrent runs cannot remove each other's file mid-upload. - Filter the `generic/invalid-socket-facts` marker out of full scan and diff artifacts, logging a warning instead. It is a diagnostic, not a dependency.
lelia
force-pushed
the
lelia/ce-422-python-cli-treats-invalid-socketfactsjson-error-as-blocking
branch
from
7e3c634 to
01f2d81
Compare
September 2, 2026 20:34
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
When a scan finds no supported manifest files, the CLI uploads a placeholder named .socket.facts.json so the upload passes the API's supported-filename validator. That placeholder was zero bytes, which the API cannot parse as a facts document — it responds by adding a synthetic generic/invalid-socket-facts@1.0.0 artifact carrying a blocking alert.
The CLI read that back as a real dependency, so the run reported a new blocking package with no manifest file and no introducing dependency, exited non-zero, and on pull requests posted a security comment that a developer had no way to act on.
Changes
Testing
tests/core/test_invalid_facts_marker.py (13 tests). The eight behavioral ones were confirmed to fail against the pre-fix code. Full suite: 492 passed.
Note
That the backend accepts the new placeholder payload is not verified against a live API — there is no no-manifest scenario in the e2e workflow. If the schema wants more, the marker filtering still prevents the block and the comment, but the placeholder would keep tripping the parser. Worth a preview build against a repository with no manifests to confirm the resulting scan carries no invalid-socket-facts artifact.
Fixes CE-422
Note
Medium Risk
Changes core scan/diff artifact handling and empty-scan upload behavior, which directly affects blocking exits and PR comments, though the logic is narrow and well-tested.
Overview
Fixes CE-422, where scans with no manifest files could fail CI and post unusable PR security comments.
Placeholder uploads no longer write a zero-byte .socket.facts.json (which the API could not parse). They now upload a minimal valid document ({"components": []}), and each run gets its own temp directory (with exit-time cleanup) instead of sharing a fixed $TMPDIR/.socket.facts.json path that concurrent jobs could clobber.
API diagnostic artifact generic/invalid-socket-facts is treated as a parse-failure signal, not a dependency: it is stripped from full-scan SBOM artifacts and from every diff bucket before package/alert assembly and count logging, with a warning when present. Runs no longer treat it as a new blocking package or PR comment fodder.
Release 2.6.9 with changelog and focused tests in test_invalid_facts_marker.py.
Reviewed by Cursor Bugbot for commit 01b89e4. Configure here.