From de02ef9ed3319e9ee2cd3e02257e5bfb206f5792 Mon Sep 17 00:00:00 2001 From: Jeppe Fredsgaard Blaabjerg Date: Sat, 31 Oct 2026 18:42:48 +0100 Subject: [PATCH 1/3] docs(manifest): name .NET in help text, messages and comments Help text and messages for dynamic SBOM inference, the setup wizards, `socket manifest` and `scan create`/`scan reach` now list .NET next to Gradle, sbt and Maven, and comments on the shared facts pipeline describe it in build-tool-neutral terms. --- .config/rollup.dist.config.mjs | 4 ++-- src/commands/manifest/cmd-manifest-auto.test.mts | 2 +- src/commands/manifest/cmd-manifest-dotnet.test.mts | 2 +- .../manifest/cmd-manifest-dynamic-sbom-inference.mts | 2 +- .../cmd-manifest-dynamic-sbom-inference.test.mts | 4 ++-- src/commands/manifest/cmd-manifest-gradle.test.mts | 2 +- src/commands/manifest/cmd-manifest-kotlin.test.mts | 2 +- src/commands/manifest/cmd-manifest-maven.test.mts | 2 +- src/commands/manifest/cmd-manifest-scala.test.mts | 2 +- src/commands/manifest/cmd-manifest-setup.mts | 2 +- src/commands/manifest/cmd-manifest-setup.test.mts | 2 +- src/commands/manifest/cmd-manifest.mts | 4 ++-- src/commands/manifest/cmd-manifest.test.mts | 2 +- src/commands/manifest/discover-manifest-roots.mts | 3 ++- .../handle-manifest-dynamic-sbom-inference.mts | 2 +- .../handle-manifest-dynamic-sbom-inference.test.mts | 2 +- src/commands/manifest/manifest-flags.mts | 2 +- src/commands/manifest/scripts/build-tool.mts | 6 +++--- src/commands/manifest/scripts/facts.mts | 3 ++- src/commands/manifest/scripts/records.mts | 10 ++++++---- .../manifest/scripts/resolution-report-render.mts | 4 ++-- src/commands/manifest/scripts/run.mts | 3 ++- src/commands/manifest/setup-manifest-config.mts | 2 +- .../manifest/setup-recursive-manifest-config.mts | 6 ++++-- .../manifest/setup-recursive-manifest-config.test.mts | 3 ++- src/commands/scan/cmd-scan-create.mts | 2 +- src/commands/scan/cmd-scan-create.test.mts | 6 +++--- src/commands/scan/cmd-scan-reach.test.mts | 4 ++-- src/commands/scan/handle-create-new-scan.mts | 4 ++-- src/commands/scan/handle-create-new-scan.test.mts | 4 ++-- src/commands/scan/handle-scan-reach.mts | 2 +- src/commands/scan/perform-reachability-analysis.mts | 2 +- src/commands/scan/reachability-flags.mts | 4 ++-- src/commands/scan/run-dynamic-sbom-inference.mts | 2 +- src/commands/scan/run-dynamic-sbom-inference.test.mts | 2 +- 35 files changed, 59 insertions(+), 51 deletions(-) diff --git a/.config/rollup.dist.config.mjs b/.config/rollup.dist.config.mjs index bfd2f751e..1c4111691 100644 --- a/.config/rollup.dist.config.mjs +++ b/.config/rollup.dist.config.mjs @@ -104,8 +104,8 @@ async function copyInitGradle() { await fs.copyFile(filepath, destPath) } -// Copy the JVM build-tool resolution assets (Gradle init script, sbt plugin, -// Maven extension jar) into dist/manifest-scripts, where run.mts resolves them +// Copy the build-tool resolution assets (Gradle init script, sbt plugin, +// Maven extension jar, dotnet tool) into dist/manifest-scripts, where run.mts resolves them // at runtime. The Maven jar is compiled by maven-extension/build-jar.sh (run in // CI / local dev) and is absent from a fresh checkout — copy it only if present; // run.mts surfaces a build hint when it's missing. diff --git a/src/commands/manifest/cmd-manifest-auto.test.mts b/src/commands/manifest/cmd-manifest-auto.test.mts index c8c7a1b12..a4166d8cb 100644 --- a/src/commands/manifest/cmd-manifest-auto.test.mts +++ b/src/commands/manifest/cmd-manifest-auto.test.mts @@ -23,7 +23,7 @@ describe('socket manifest auto', async () => { $ socket manifest auto [options] [CWD=.] Options - --exclude-paths List of glob patterns to exclude from manifest/facts generation. Patterns are anchored micromatch globs matched relative to CWD (\`--cwd\` if set): \`tests\` matches only \`/tests\`; use \`**/tests\` to match at any depth. Negation patterns (\`!path\`) are not supported. Accepts a comma-separated value or multiple flags. An excluded JVM build module is not analysed as a project of its own, but where a project that is not excluded depends on it, its code is analysed as part of that project. A build module outside CWD cannot be excluded. + --exclude-paths List of glob patterns to exclude from manifest/facts generation. Patterns are anchored micromatch globs matched relative to CWD (\`--cwd\` if set): \`tests\` matches only \`/tests\`; use \`**/tests\` to match at any depth. Negation patterns (\`!path\`) are not supported. Accepts a comma-separated value or multiple flags. An excluded JVM build module or .NET project is not analysed as a project of its own, but where a project that is not excluded depends on it, its code is analysed as part of that project. --verbose Enable debug output (only for auto itself; sub-steps need to have it pre-configured), may help when running into errors Tries to figure out what language your target repo uses. If it finds a diff --git a/src/commands/manifest/cmd-manifest-dotnet.test.mts b/src/commands/manifest/cmd-manifest-dotnet.test.mts index 56a605371..fa120bc05 100644 --- a/src/commands/manifest/cmd-manifest-dotnet.test.mts +++ b/src/commands/manifest/cmd-manifest-dotnet.test.mts @@ -25,7 +25,7 @@ describe('socket manifest dotnet', async () => { --bin Location of the dotnet binary to use, default: dotnet on PATH --dotnet-opts Additional options to pass on to \`dotnet restore\`, e.g. \`-p:Configuration=Release --configfile nuget.config\`. MSBuild properties among them also apply to project evaluation --exclude-configs Comma-separated glob patterns; target frameworks matching any pattern are skipped (applied after --include-configs) - --exclude-paths List of glob patterns to exclude from manifest/facts generation. Patterns are anchored micromatch globs matched relative to CWD (\`--cwd\` if set): \`tests\` matches only \`/tests\`; use \`**/tests\` to match at any depth. Negation patterns (\`!path\`) are not supported. Accepts a comma-separated value or multiple flags. An excluded JVM build module is not analysed as a project of its own, but where a project that is not excluded depends on it, its code is analysed as part of that project. A build module outside CWD cannot be excluded. + --exclude-paths List of glob patterns to exclude from manifest/facts generation. Patterns are anchored micromatch globs matched relative to CWD (\`--cwd\` if set): \`tests\` matches only \`/tests\`; use \`**/tests\` to match at any depth. Negation patterns (\`!path\`) are not supported. Accepts a comma-separated value or multiple flags. An excluded JVM build module or .NET project is not analysed as a project of its own, but where a project that is not excluded depends on it, its code is analysed as part of that project. --ignore-unresolved Warn on unresolved dependencies instead of failing the run (unresolved deps are not emitted to the facts file) --include-configs Comma-separated glob patterns matched against target frameworks (case-sensitive; \`*\`, \`?\`, and \`[...]\` wildcards). Only target frameworks matching at least one pattern are read, e.g. \`net8.0\`. A runtime-specific target (\`net8.0/win-x64\`) also matches its framework. Default: every target framework --verbose Print debug messages diff --git a/src/commands/manifest/cmd-manifest-dynamic-sbom-inference.mts b/src/commands/manifest/cmd-manifest-dynamic-sbom-inference.mts index 9385ab41f..a36e57b82 100644 --- a/src/commands/manifest/cmd-manifest-dynamic-sbom-inference.mts +++ b/src/commands/manifest/cmd-manifest-dynamic-sbom-inference.mts @@ -21,7 +21,7 @@ import type { const config: CliCommandConfig = { commandName: 'dynamic-sbom-inference', description: - 'Recursively discover gradle/sbt/maven build roots and generate a Socket facts SBOM for each', + 'Recursively discover gradle/sbt/maven/dotnet build roots and generate a Socket facts SBOM for each', hidden: false, flags: { ...commonFlags, diff --git a/src/commands/manifest/cmd-manifest-dynamic-sbom-inference.test.mts b/src/commands/manifest/cmd-manifest-dynamic-sbom-inference.test.mts index 59eb074f4..3cfe4fffa 100644 --- a/src/commands/manifest/cmd-manifest-dynamic-sbom-inference.test.mts +++ b/src/commands/manifest/cmd-manifest-dynamic-sbom-inference.test.mts @@ -18,7 +18,7 @@ describe('socket manifest dynamic-sbom-inference', async () => { cwd: testPath, }) expect(stdout).toMatchInlineSnapshot(` - "Recursively discover gradle/sbt/maven build roots and generate a Socket facts SBOM for each + "Recursively discover gradle/sbt/maven/dotnet build roots and generate a Socket facts SBOM for each Usage $ socket manifest dynamic-sbom-inference [options] [CWD=.] @@ -33,7 +33,7 @@ describe('socket manifest dynamic-sbom-inference', async () => { CWD itself. Options - --exclude-paths List of glob patterns to exclude from manifest/facts generation. Patterns are anchored micromatch globs matched relative to CWD (\`--cwd\` if set): \`tests\` matches only \`/tests\`; use \`**/tests\` to match at any depth. Negation patterns (\`!path\`) are not supported. Accepts a comma-separated value or multiple flags. An excluded JVM build module is not analysed as a project of its own, but where a project that is not excluded depends on it, its code is analysed as part of that project. A build module outside CWD cannot be excluded. + --exclude-paths List of glob patterns to exclude from manifest/facts generation. Patterns are anchored micromatch globs matched relative to CWD (\`--cwd\` if set): \`tests\` matches only \`/tests\`; use \`**/tests\` to match at any depth. Negation patterns (\`!path\`) are not supported. Accepts a comma-separated value or multiple flags. An excluded JVM build module or .NET project is not analysed as a project of its own, but where a project that is not excluded depends on it, its code is analysed as part of that project. --ignore-unresolved Warn on unresolved dependencies instead of failing the run (unresolved deps are not emitted to the facts files); overrides each build's socket.json setting --json Output as JSON --markdown Output as Markdown diff --git a/src/commands/manifest/cmd-manifest-gradle.test.mts b/src/commands/manifest/cmd-manifest-gradle.test.mts index 629468872..7f8124e4c 100644 --- a/src/commands/manifest/cmd-manifest-gradle.test.mts +++ b/src/commands/manifest/cmd-manifest-gradle.test.mts @@ -25,7 +25,7 @@ describe('socket manifest gradle', async () => { Options --bin Location of the gradle binary to use, default: ./gradlew if present, else gradle on PATH --exclude-configs When generating facts: comma-separated glob patterns; Gradle configurations matching any pattern are skipped (applied after --include-configs) - --exclude-paths List of glob patterns to exclude from manifest/facts generation. Patterns are anchored micromatch globs matched relative to CWD (\`--cwd\` if set): \`tests\` matches only \`/tests\`; use \`**/tests\` to match at any depth. Negation patterns (\`!path\`) are not supported. Accepts a comma-separated value or multiple flags. An excluded JVM build module is not analysed as a project of its own, but where a project that is not excluded depends on it, its code is analysed as part of that project. A build module outside CWD cannot be excluded. + --exclude-paths List of glob patterns to exclude from manifest/facts generation. Patterns are anchored micromatch globs matched relative to CWD (\`--cwd\` if set): \`tests\` matches only \`/tests\`; use \`**/tests\` to match at any depth. Negation patterns (\`!path\`) are not supported. Accepts a comma-separated value or multiple flags. An excluded JVM build module or .NET project is not analysed as a project of its own, but where a project that is not excluded depends on it, its code is analysed as part of that project. --facts Emit a Socket facts JSON file (\`gradle.socket.facts.json\`) describing the resolved dependency graph. This is the default; pass \`--pom\` to generate \`pom.xml\` files instead --gradle-opts Additional options to pass on to ./gradlew, see \`./gradlew --help\` --ignore-unresolved When generating facts: warn on unresolved dependencies instead of failing the run (unresolved deps are not emitted to the facts file) diff --git a/src/commands/manifest/cmd-manifest-kotlin.test.mts b/src/commands/manifest/cmd-manifest-kotlin.test.mts index cd9c2893f..958fdaf09 100644 --- a/src/commands/manifest/cmd-manifest-kotlin.test.mts +++ b/src/commands/manifest/cmd-manifest-kotlin.test.mts @@ -25,7 +25,7 @@ describe('socket manifest kotlin', async () => { Options --bin Location of the gradle binary to use, default: ./gradlew if present, else gradle on PATH --exclude-configs When generating facts: comma-separated glob patterns; Gradle configurations matching any pattern are skipped (applied after --include-configs) - --exclude-paths List of glob patterns to exclude from manifest/facts generation. Patterns are anchored micromatch globs matched relative to CWD (\`--cwd\` if set): \`tests\` matches only \`/tests\`; use \`**/tests\` to match at any depth. Negation patterns (\`!path\`) are not supported. Accepts a comma-separated value or multiple flags. An excluded JVM build module is not analysed as a project of its own, but where a project that is not excluded depends on it, its code is analysed as part of that project. A build module outside CWD cannot be excluded. + --exclude-paths List of glob patterns to exclude from manifest/facts generation. Patterns are anchored micromatch globs matched relative to CWD (\`--cwd\` if set): \`tests\` matches only \`/tests\`; use \`**/tests\` to match at any depth. Negation patterns (\`!path\`) are not supported. Accepts a comma-separated value or multiple flags. An excluded JVM build module or .NET project is not analysed as a project of its own, but where a project that is not excluded depends on it, its code is analysed as part of that project. --facts Emit a Socket facts JSON file (\`gradle.socket.facts.json\`) describing the resolved dependency graph. This is the default; pass \`--pom\` to generate \`pom.xml\` files instead --gradle-opts Additional options to pass on to ./gradlew, see \`./gradlew --help\` --ignore-unresolved When generating facts: warn on unresolved dependencies instead of failing the run (unresolved deps are not emitted to the facts file) diff --git a/src/commands/manifest/cmd-manifest-maven.test.mts b/src/commands/manifest/cmd-manifest-maven.test.mts index 20cdb39f3..f3f1a51a5 100644 --- a/src/commands/manifest/cmd-manifest-maven.test.mts +++ b/src/commands/manifest/cmd-manifest-maven.test.mts @@ -24,7 +24,7 @@ describe('socket manifest maven', async () => { Options --bin Location of the maven binary to use, default: ./mvnw if present, else mvn on PATH --exclude-configs Comma-separated glob patterns; Maven scopes matching any pattern are skipped (applied after --include-configs) - --exclude-paths List of glob patterns to exclude from manifest/facts generation. Patterns are anchored micromatch globs matched relative to CWD (\`--cwd\` if set): \`tests\` matches only \`/tests\`; use \`**/tests\` to match at any depth. Negation patterns (\`!path\`) are not supported. Accepts a comma-separated value or multiple flags. An excluded JVM build module is not analysed as a project of its own, but where a project that is not excluded depends on it, its code is analysed as part of that project. A build module outside CWD cannot be excluded. + --exclude-paths List of glob patterns to exclude from manifest/facts generation. Patterns are anchored micromatch globs matched relative to CWD (\`--cwd\` if set): \`tests\` matches only \`/tests\`; use \`**/tests\` to match at any depth. Negation patterns (\`!path\`) are not supported. Accepts a comma-separated value or multiple flags. An excluded JVM build module or .NET project is not analysed as a project of its own, but where a project that is not excluded depends on it, its code is analysed as part of that project. --ignore-unresolved Warn on unresolved dependencies instead of failing the run (unresolved deps are not emitted to the facts file) --include-configs Comma-separated glob patterns matched against Maven dependency scopes (case-sensitive; \`*\`, \`?\`, and \`[...]\` wildcards). Only scopes matching at least one pattern are resolved. e.g. \`compile,runtime\`. Default: every scope --maven-opts Additional options to pass on to maven, e.g. \`-P -s \` diff --git a/src/commands/manifest/cmd-manifest-scala.test.mts b/src/commands/manifest/cmd-manifest-scala.test.mts index c34e00256..251622c70 100644 --- a/src/commands/manifest/cmd-manifest-scala.test.mts +++ b/src/commands/manifest/cmd-manifest-scala.test.mts @@ -25,7 +25,7 @@ describe('socket manifest scala', async () => { Options --bin Location of sbt binary to use --exclude-configs When generating facts: comma-separated glob patterns; sbt configurations matching any pattern are skipped (applied after --include-configs) - --exclude-paths List of glob patterns to exclude from manifest/facts generation. Patterns are anchored micromatch globs matched relative to CWD (\`--cwd\` if set): \`tests\` matches only \`/tests\`; use \`**/tests\` to match at any depth. Negation patterns (\`!path\`) are not supported. Accepts a comma-separated value or multiple flags. An excluded JVM build module is not analysed as a project of its own, but where a project that is not excluded depends on it, its code is analysed as part of that project. A build module outside CWD cannot be excluded. + --exclude-paths List of glob patterns to exclude from manifest/facts generation. Patterns are anchored micromatch globs matched relative to CWD (\`--cwd\` if set): \`tests\` matches only \`/tests\`; use \`**/tests\` to match at any depth. Negation patterns (\`!path\`) are not supported. Accepts a comma-separated value or multiple flags. An excluded JVM build module or .NET project is not analysed as a project of its own, but where a project that is not excluded depends on it, its code is analysed as part of that project. --facts Emit a Socket facts JSON file (\`sbt.socket.facts.json\`) describing the resolved dependency graph. This is the default; pass \`--pom\` to generate \`pom.xml\` files instead --ignore-unresolved When generating facts: warn on unresolved dependencies instead of failing the run (unresolved deps are not emitted to the facts file) --include-configs When generating facts: comma-separated glob patterns matched against sbt configuration names (case-sensitive; \`*\`, \`?\`, and \`[...]\` wildcards). Only configurations matching at least one pattern are resolved. e.g. \`compile,test\`. Default: compile,optional,provided,runtime,test diff --git a/src/commands/manifest/cmd-manifest-setup.mts b/src/commands/manifest/cmd-manifest-setup.mts index d7dd024e3..594c7dcf0 100644 --- a/src/commands/manifest/cmd-manifest-setup.mts +++ b/src/commands/manifest/cmd-manifest-setup.mts @@ -36,7 +36,7 @@ const config: CliCommandConfig = { dynamicSbomInference: { type: 'boolean', description: - 'Generates dynamic SBOMs via the Gradle/sbt/Maven package manager tools for more accurate results than static resolution. Scans every build root under CWD first, so the configurator only asks about ecosystems actually found; --exclude-paths matches are bulk-disabled, others configured individually.', + 'Generates dynamic SBOMs via the Gradle/sbt/Maven/.NET package manager tools for more accurate results than static resolution. Scans every build root under CWD first, so the configurator only asks about ecosystems actually found; --exclude-paths matches are bulk-disabled, others configured individually.', }, }, help: (command, config) => ` diff --git a/src/commands/manifest/cmd-manifest-setup.test.mts b/src/commands/manifest/cmd-manifest-setup.test.mts index 780fe482e..2b0b98007 100644 --- a/src/commands/manifest/cmd-manifest-setup.test.mts +++ b/src/commands/manifest/cmd-manifest-setup.test.mts @@ -24,7 +24,7 @@ describe('socket manifest setup', async () => { Options --default-on-read-error If reading the socket.json fails, just use a default config? Warning: This might override the existing json file! - --dynamic-sbom-inference Generates dynamic SBOMs via the Gradle/sbt/Maven package manager tools for more accurate results than static resolution. Scans every build root under CWD first, so the configurator only asks about ecosystems actually found; --exclude-paths matches are bulk-disabled, others configured individually. + --dynamic-sbom-inference Generates dynamic SBOMs via the Gradle/sbt/Maven/.NET package manager tools for more accurate results than static resolution. Scans every build root under CWD first, so the configurator only asks about ecosystems actually found; --exclude-paths matches are bulk-disabled, others configured individually. --exclude-paths Build roots matching these glob patterns (and everything beneath them) are marked disabled. Patterns are anchored micromatch globs matched relative to CWD: \`legacy\` matches only \`/legacy\`; use \`**/legacy\` to match at any depth. Negation patterns (\`!path\`) are not supported. Accepts a comma-separated value or multiple flags. This command will try to detect all supported ecosystems in given CWD. Then diff --git a/src/commands/manifest/cmd-manifest.mts b/src/commands/manifest/cmd-manifest.mts index 448aaea6d..3fbf37081 100644 --- a/src/commands/manifest/cmd-manifest.mts +++ b/src/commands/manifest/cmd-manifest.mts @@ -41,8 +41,8 @@ const config: CliCommandConfig = { configurations available. See \`manifest --help\` for usage details per language. - Currently supported language: bazel [beta], gradle [beta], kotlin (through - gradle) [beta], maven [beta], scala [beta]. + Currently supported language: bazel [beta], dotnet [beta], gradle [beta], + kotlin (through gradle) [beta], maven [beta], scala [beta]. Examples diff --git a/src/commands/manifest/cmd-manifest.test.mts b/src/commands/manifest/cmd-manifest.test.mts index 05c276c35..13ee0984e 100644 --- a/src/commands/manifest/cmd-manifest.test.mts +++ b/src/commands/manifest/cmd-manifest.test.mts @@ -28,7 +28,7 @@ describe('socket manifest', async () => { cdxgen Run cdxgen for SBOM generation conda [beta] Convert a Conda environment.yml file to a python requirements.txt dotnet [beta] Generate Socket facts files from .NET solutions and projects - dynamic-sbom-inference Recursively discover gradle/sbt/maven build roots and generate a Socket facts SBOM for each + dynamic-sbom-inference Recursively discover gradle/sbt/maven/dotnet build roots and generate a Socket facts SBOM for each gradle [beta] Generate a Socket facts file (or \`pom.xml\` with --pom) for a Gradle/Java/Kotlin/etc project kotlin [beta] Generate a Socket facts file (or \`pom.xml\` with --pom) for a Kotlin project maven [beta] Generate a Socket facts file from a Maven \`pom.xml\` project diff --git a/src/commands/manifest/discover-manifest-roots.mts b/src/commands/manifest/discover-manifest-roots.mts index 3dd651bca..1665bc708 100644 --- a/src/commands/manifest/discover-manifest-roots.mts +++ b/src/commands/manifest/discover-manifest-roots.mts @@ -94,7 +94,8 @@ async function realFilePath(file: string): Promise { } // Gradle reports a project's build file even when absent, which covers -// nothing. A sibling outside the build root is independently locatable. +// nothing. A sibling outside the build root is independently locatable, +// unless its projects resolve alone. export async function addCoveredBuildFiles( covered: Set, tool: BuildTool, diff --git a/src/commands/manifest/handle-manifest-dynamic-sbom-inference.mts b/src/commands/manifest/handle-manifest-dynamic-sbom-inference.mts index 81cedbebc..79613e920 100644 --- a/src/commands/manifest/handle-manifest-dynamic-sbom-inference.mts +++ b/src/commands/manifest/handle-manifest-dynamic-sbom-inference.mts @@ -30,7 +30,7 @@ export async function handleManifestDynamicSbomInference({ ok: false, code: 1, message: - 'No Gradle, sbt, or Maven build root was found beneath the given directory.', + 'No Gradle, sbt, Maven or .NET build root was found beneath the given directory.', data: outcomes, } : outcomes.some(o => o.status === 'failed') diff --git a/src/commands/manifest/handle-manifest-dynamic-sbom-inference.test.mts b/src/commands/manifest/handle-manifest-dynamic-sbom-inference.test.mts index 58fe7c219..ea9753ec3 100644 --- a/src/commands/manifest/handle-manifest-dynamic-sbom-inference.test.mts +++ b/src/commands/manifest/handle-manifest-dynamic-sbom-inference.test.mts @@ -34,7 +34,7 @@ describe('handleManifestDynamicSbomInference', () => { ok: false, code: 1, message: - 'No Gradle, sbt, or Maven build root was found beneath the given directory.', + 'No Gradle, sbt, Maven or .NET build root was found beneath the given directory.', data: [], }, 'text', diff --git a/src/commands/manifest/manifest-flags.mts b/src/commands/manifest/manifest-flags.mts index 604b40d6d..bbfb0fb59 100644 --- a/src/commands/manifest/manifest-flags.mts +++ b/src/commands/manifest/manifest-flags.mts @@ -8,6 +8,6 @@ export const excludePathsFlag: MeowFlags = { type: 'string', isMultiple: true, description: - 'List of glob patterns to exclude from manifest/facts generation. Patterns are anchored micromatch globs matched relative to CWD (`--cwd` if set): `tests` matches only `/tests`; use `**/tests` to match at any depth. Negation patterns (`!path`) are not supported. Accepts a comma-separated value or multiple flags. An excluded JVM build module is not analysed as a project of its own, but where a project that is not excluded depends on it, its code is analysed as part of that project. A build module outside CWD cannot be excluded.', + 'List of glob patterns to exclude from manifest/facts generation. Patterns are anchored micromatch globs matched relative to CWD (`--cwd` if set): `tests` matches only `/tests`; use `**/tests` to match at any depth. Negation patterns (`!path`) are not supported. Accepts a comma-separated value or multiple flags. An excluded JVM build module or .NET project is not analysed as a project of its own, but where a project that is not excluded depends on it, its code is analysed as part of that project. A build module or project outside CWD cannot be excluded.', }, } diff --git a/src/commands/manifest/scripts/build-tool.mts b/src/commands/manifest/scripts/build-tool.mts index 5db050c58..b6c31497e 100644 --- a/src/commands/manifest/scripts/build-tool.mts +++ b/src/commands/manifest/scripts/build-tool.mts @@ -37,9 +37,9 @@ const BUILD_TOOL_WRAPPER = { maven: 'mvnw', } as unknown as Partial> -// Maven builds by file (`mvn --file`), so a directory can hold several: the -// POMs a scan uploads, matched case-insensitively. `walkGlob` is a -// case-sensitive superset of `nocaseGlob`, for the walk. +// Maven (`mvn --file`) and dotnet (`dotnet restore `) build by file, so +// a directory can hold several builds, matched case-insensitively. `walkGlob` +// is a case-sensitive superset of `nocaseGlob`, for the walk. export type BuildFiles = | { byFile: false; names: readonly string[] } | { diff --git a/src/commands/manifest/scripts/facts.mts b/src/commands/manifest/scripts/facts.mts index 312ceea7f..97557df27 100644 --- a/src/commands/manifest/scripts/facts.mts +++ b/src/commands/manifest/scripts/facts.mts @@ -48,7 +48,8 @@ export type SocketFactsSbomDependency = { export type SocketFactsSbomProject = AnyPURL & { // The build tool's own project identity, unique within the facts file: - // Maven's GAV, Gradle's project path, sbt's project id. + // Maven's GAV, Gradle's project path, sbt's project id, the project file's + // build-root-relative path for dotnet. id: string subprojectDir: string // The build files the tool reports for the project, e.g. a POM other than diff --git a/src/commands/manifest/scripts/records.mts b/src/commands/manifest/scripts/records.mts index 3c2bb2e46..897f482eb 100644 --- a/src/commands/manifest/scripts/records.mts +++ b/src/commands/manifest/scripts/records.mts @@ -6,16 +6,18 @@ import type { ResolutionFailure, Unscannable } from './resolution-report.mts' // // \t\t... // -// meta tool toolVersion javaVersion +// meta tool toolVersion javaVersion (dotnet: the SDK version; no javaVersion) // buildRoot path (absolute; the facts file's directory) // entry path (file-addressed builds; build-root-relative) // member path (dotnet --members: a project the entry builds; build-root-relative) // project projectKey group name version dir -// projectSrc projectKey path (--with-files only) -// projectTgt projectKey path (--with-files only) +// projectSrc projectKey path [config] (--with-files only) +// projectTgt projectKey path [config] (--with-files only) +// projectInfo projectKey config name value (dotnet, --with-files only; a name may repeat) +// projectUsing projectKey config namespace alias static(0|1) (dotnet, --with-files only) // projectBuild projectKey path (build-root-relative; may be absent on disk) // excludedProject projectKey (--with-files only; paths without a project) -// root rootId projectKey config prod(0|1) +// root rootId projectKey config prod(0|1) [framework runtime alias] (dotnet: NuGet short folder name, RID, TargetFrameworks entry) // node rootId coordId group name version ext classifier direct(0|1) project // edge rootId parentCoordId childCoordId // file rootId coordId path (--with-files only) diff --git a/src/commands/manifest/scripts/resolution-report-render.mts b/src/commands/manifest/scripts/resolution-report-render.mts index 4b2b61b20..e3d9bb818 100644 --- a/src/commands/manifest/scripts/resolution-report-render.mts +++ b/src/commands/manifest/scripts/resolution-report-render.mts @@ -88,8 +88,8 @@ const RESOLUTION_REPORT_ARTIFACT_LIMIT = 15 const RESOLUTION_REPORT_CONFIG_LIMIT = 20 // Drop a bare "group:name" when a versioned "group:name:v" of the same module -// failed in the same projects: the lenient resolver reports both forms for one -// failure. +// failed in the same projects (or, outside any project, also outside one): the +// lenient resolver reports both forms for one failure. function dedupInfos }>( infos: T[], ): T[] { diff --git a/src/commands/manifest/scripts/run.mts b/src/commands/manifest/scripts/run.mts index 7896ffb8c..c7a751dce 100644 --- a/src/commands/manifest/scripts/run.mts +++ b/src/commands/manifest/scripts/run.mts @@ -26,7 +26,8 @@ export type ManifestScriptOptions = { projectDir: string // Unset ⇒ resolved to the project wrapper, else PATH (resolveBuildToolBin). bin?: string | undefined - // Maven only: the POM in projectDir to build; unset leaves Maven's default. + // The file in projectDir to build: Maven's POM (unset leaves Maven's + // default), dotnet's solution or project (required). entryFile?: string | undefined // Reachability-only: also materialize resolved artifact paths (artifactPaths). withFiles?: boolean | undefined diff --git a/src/commands/manifest/setup-manifest-config.mts b/src/commands/manifest/setup-manifest-config.mts index 15912af18..8cbd34f4f 100644 --- a/src/commands/manifest/setup-manifest-config.mts +++ b/src/commands/manifest/setup-manifest-config.mts @@ -716,7 +716,7 @@ async function askForIgnoreUnresolvedFlag( }) } -// Prompts for the facts-only options shared by gradle and sbt: the config +// Prompts for the facts-only options every facts generator shares: the config // include/exclude filters and --ignore-unresolved. Mutates `config` in place. async function setupFactsOptions( config: { diff --git a/src/commands/manifest/setup-recursive-manifest-config.mts b/src/commands/manifest/setup-recursive-manifest-config.mts index e2a0e1dc8..3cffc5bc2 100644 --- a/src/commands/manifest/setup-recursive-manifest-config.mts +++ b/src/commands/manifest/setup-recursive-manifest-config.mts @@ -759,7 +759,9 @@ export async function setupRecursiveManifestConfig( `Detected: ${detectedEcosystems.map(ecosystem => ECOSYSTEM_LABELS[ecosystem]).join(', ')}.`, ) } else { - logger.log(`No gradle/maven/sbt build roots found beneath ${cwd}.`) + logger.log( + `No Gradle, Maven, sbt or .NET build roots found beneath ${cwd}.`, + ) // Distinct from "found some, but --exclude-paths excluded them all" - // that's a deliberate choice and setup still proceeds normally below. // Zero build roots anywhere means --dynamic-sbom-inference doesn't apply @@ -771,7 +773,7 @@ export async function setupRecursiveManifestConfig( return { ok: false, code: 1, - message: `No Gradle, sbt, or Maven build root was found beneath ${cwd}.`, + message: `No Gradle, sbt, Maven or .NET build root was found beneath ${cwd}.`, } } } diff --git a/src/commands/manifest/setup-recursive-manifest-config.test.mts b/src/commands/manifest/setup-recursive-manifest-config.test.mts index fa7eb32e9..34ca9e0fb 100644 --- a/src/commands/manifest/setup-recursive-manifest-config.test.mts +++ b/src/commands/manifest/setup-recursive-manifest-config.test.mts @@ -914,7 +914,8 @@ describe('setupRecursiveManifestConfig', () => { expect(result).toEqual({ ok: false, code: 1, - message: 'No Gradle, sbt, or Maven build root was found beneath /repo.', + message: + 'No Gradle, sbt, Maven or .NET build root was found beneath /repo.', }) expect(select).not.toHaveBeenCalled() expect(setupGradle).not.toHaveBeenCalled() diff --git a/src/commands/scan/cmd-scan-create.mts b/src/commands/scan/cmd-scan-create.mts index aa5ac4bab..37a8cdc50 100644 --- a/src/commands/scan/cmd-scan-create.mts +++ b/src/commands/scan/cmd-scan-create.mts @@ -73,7 +73,7 @@ const generalFlags: MeowFlags = { autoManifest: { type: 'boolean', description: - 'Run `socket manifest auto` before collecting manifest files, which generates them for ecosystems that need their build tool to resolve dependencies, such as Scala, Gradle, and Kotlin. See `socket manifest auto --help`. For Gradle, sbt, and Maven, --dynamic-sbom-inference generates a Socket facts SBOM per build root instead.', + 'Run `socket manifest auto` before collecting manifest files, which generates them for ecosystems that need their build tool to resolve dependencies, such as Scala, Gradle, and Kotlin. See `socket manifest auto --help`. For Gradle, sbt, Maven and .NET, --dynamic-sbom-inference generates a Socket facts SBOM per build root instead.', }, branch: { type: 'string', diff --git a/src/commands/scan/cmd-scan-create.test.mts b/src/commands/scan/cmd-scan-create.test.mts index b8aedc1bf..bec426082 100644 --- a/src/commands/scan/cmd-scan-create.test.mts +++ b/src/commands/scan/cmd-scan-create.test.mts @@ -97,15 +97,15 @@ describe('socket scan create', async () => { - Permissions: full-scans:create Options - --auto-manifest Run \`socket manifest auto\` before collecting manifest files, which generates them for ecosystems that need their build tool to resolve dependencies, such as Scala, Gradle, and Kotlin. See \`socket manifest auto --help\`. For Gradle, sbt, and Maven, --dynamic-sbom-inference generates a Socket facts SBOM per build root instead. + --auto-manifest Run \`socket manifest auto\` before collecting manifest files, which generates them for ecosystems that need their build tool to resolve dependencies, such as Scala, Gradle, and Kotlin. See \`socket manifest auto --help\`. For Gradle, sbt, Maven and .NET, --dynamic-sbom-inference generates a Socket facts SBOM per build root instead. --branch Branch name --commit-hash Commit hash --commit-message Commit message --committers Committers --cwd working directory, defaults to process.cwd() --default-branch Set the default branch of the repository to the branch of this full-scan. Should only need to be done once, for example for the "main" or "master" branch. - --dynamic-sbom-inference For Gradle, sbt, and Maven: generate a Socket facts SBOM (produced directly by each package manager) per independent build root, instead of one synthetic root. Combine with --reach to split the reachability analysis per project/module. - --exclude-paths List of glob patterns to exclude from the scan, including SCA/SBOM manifest discovery and (when --reach is enabled) full application reachability analysis. Patterns are anchored micromatch globs matched relative to the Socket scan root, which is the command working directory (\`--cwd\` if set), not the reachability target: \`tests\` matches only \`/tests\`; use \`**/tests\` to match at any depth. Negation patterns (\`!path\`) are not supported. Accepts a comma-separated value or multiple flags. An excluded JVM build module is not analysed as a project of its own, but where a project that is not excluded depends on it, its code is analysed as part of that project. A build module outside the scan root cannot be excluded. + --dynamic-sbom-inference For Gradle, sbt, Maven and .NET: generate a Socket facts SBOM (produced directly by each package manager) per independent build root, instead of one synthetic root. Combine with --reach to split the reachability analysis per project/module. + --exclude-paths List of glob patterns to exclude from the scan, including SCA/SBOM manifest discovery and (when --reach is enabled) full application reachability analysis. Patterns are anchored micromatch globs matched relative to the Socket scan root, which is the command working directory (\`--cwd\` if set), not the reachability target: \`tests\` matches only \`/tests\`; use \`**/tests\` to match at any depth. Negation patterns (\`!path\`) are not supported. Accepts a comma-separated value or multiple flags. An excluded JVM build module or .NET project is not analysed as a project of its own, but where a project that is not excluded depends on it, its code is analysed as part of that project. --interactive Allow for interactive elements, asking for input. Use --no-interactive to prevent any input questions, defaulting them to cancel/no. --json Output as JSON --markdown Output as Markdown diff --git a/src/commands/scan/cmd-scan-reach.test.mts b/src/commands/scan/cmd-scan-reach.test.mts index 1f2b7c0e0..347b9c2c3 100644 --- a/src/commands/scan/cmd-scan-reach.test.mts +++ b/src/commands/scan/cmd-scan-reach.test.mts @@ -37,8 +37,8 @@ describe('socket scan reach', async () => { --output Path to write the reachability report to (must end with .json). Defaults to .socket.facts.json in the current working directory. Reachability Options - --dynamic-sbom-inference For Gradle, sbt, and Maven: generate a Socket facts SBOM (produced directly by each package manager) per independent build root, instead of one synthetic root. The reachability analysis is split per project/module accordingly. - --exclude-paths List of glob patterns to exclude from the scan, including SCA/SBOM manifest discovery and (when --reach is enabled) full application reachability analysis. Patterns are anchored micromatch globs matched relative to the Socket scan root, which is the command working directory (\`--cwd\` if set), not the reachability target: \`tests\` matches only \`/tests\`; use \`**/tests\` to match at any depth. Negation patterns (\`!path\`) are not supported. Accepts a comma-separated value or multiple flags. An excluded JVM build module is not analysed as a project of its own, but where a project that is not excluded depends on it, its code is analysed as part of that project. A build module outside the scan root cannot be excluded. + --dynamic-sbom-inference For Gradle, sbt, Maven and .NET: generate a Socket facts SBOM (produced directly by each package manager) per independent build root, instead of one synthetic root. The reachability analysis is split per project/module accordingly. + --exclude-paths List of glob patterns to exclude from the scan, including SCA/SBOM manifest discovery and (when --reach is enabled) full application reachability analysis. Patterns are anchored micromatch globs matched relative to the Socket scan root, which is the command working directory (\`--cwd\` if set), not the reachability target: \`tests\` matches only \`/tests\`; use \`**/tests\` to match at any depth. Negation patterns (\`!path\`) are not supported. Accepts a comma-separated value or multiple flags. An excluded JVM build module or .NET project is not analysed as a project of its own, but where a project that is not excluded depends on it, its code is analysed as part of that project. --reach-advisories List of advisories to run reachability analysis for, as GHSA or CVE IDs, either as a comma separated value or as multiple flags. CVE IDs are converted to GHSA IDs through the GitHub API. Vulnerabilities from other advisories get unknown reachability. Defaults to all advisories. --reach-analysis-memory-limit The maximum memory for the reachability analysis as a whole number optionally followed by MB or GB (e.g. 512MB, 8GB). The default is 8GB. --reach-analysis-timeout Set the timeout for the reachability analysis as a whole number optionally followed by s, m or h (e.g. 90s, 10m, 1h). Defaults to 10m. Split analysis runs may cause the total scan time to exceed this timeout significantly. diff --git a/src/commands/scan/handle-create-new-scan.mts b/src/commands/scan/handle-create-new-scan.mts index 643e1a55b..dd15c54ed 100644 --- a/src/commands/scan/handle-create-new-scan.mts +++ b/src/commands/scan/handle-create-new-scan.mts @@ -171,8 +171,8 @@ async function createNewScan( if (reach.dynamicSbomInference) { // Recursively discover and generate Socket facts for every - // independent gradle/sbt/maven build root instead of only the one at - // cwd. This runs on its own, so nothing outside those three + // independent dotnet/gradle/sbt/maven build root instead of only the + // one at cwd. This runs on its own, so nothing outside those // ecosystems is generated unless --auto-manifest also asked for it. const dynamicResult = await runDynamicSbomInference({ cwd, diff --git a/src/commands/scan/handle-create-new-scan.test.mts b/src/commands/scan/handle-create-new-scan.test.mts index 4d2105703..3db5fcb0c 100644 --- a/src/commands/scan/handle-create-new-scan.test.mts +++ b/src/commands/scan/handle-create-new-scan.test.mts @@ -440,14 +440,14 @@ describe('handleCreateNewScan excludePaths', () => { expect(mockFetchCreateOrgFullScan).not.toHaveBeenCalled() }) - it('aborts when --dynamic-sbom-inference finds no Gradle/sbt/Maven build root', async () => { + it('aborts when --dynamic-sbom-inference finds no build root', async () => { mockGenerateRecursiveManifests.mockResolvedValueOnce([]) const config = createConfig({ autoManifest: false, targets: ['/repo'] }) config.reach.dynamicSbomInference = true await expect(handleCreateNewScan(config)).rejects.toThrow( - /No Gradle, sbt, or Maven build root was found/, + /No Gradle, sbt, Maven or .NET build root was found/, ) expect(mockGetPackageFilesForScan).not.toHaveBeenCalled() expect(mockFetchCreateOrgFullScan).not.toHaveBeenCalled() diff --git a/src/commands/scan/handle-scan-reach.mts b/src/commands/scan/handle-scan-reach.mts index 5e534e16b..8d4082dee 100644 --- a/src/commands/scan/handle-scan-reach.mts +++ b/src/commands/scan/handle-scan-reach.mts @@ -49,7 +49,7 @@ async function runScanReach( if (reachabilityOptions.dynamicSbomInference) { logger.info( - 'Generating Socket facts for each Gradle, sbt, and Maven build root ...', + 'Generating Socket facts for each Gradle, sbt, Maven and .NET build root ...', ) const dynamicResult = await runDynamicSbomInference({ cwd, diff --git a/src/commands/scan/perform-reachability-analysis.mts b/src/commands/scan/perform-reachability-analysis.mts index 4d0bdff12..e2d495b17 100644 --- a/src/commands/scan/perform-reachability-analysis.mts +++ b/src/commands/scan/perform-reachability-analysis.mts @@ -192,7 +192,7 @@ export async function performReachabilityAnalysis( // Temp file for --compute-artifacts-sidecar, removed in the finally below. // Written even when empty under dynamicSbomInference, since the - // --maven-use-only-socket-facts flag below requires one to be present. + // facts-only flag below requires one to be present. let sidecarPath: string | undefined if ( reachabilityOptions.dynamicSbomInference || diff --git a/src/commands/scan/reachability-flags.mts b/src/commands/scan/reachability-flags.mts index 1e980b05f..be7b9e890 100644 --- a/src/commands/scan/reachability-flags.mts +++ b/src/commands/scan/reachability-flags.mts @@ -7,7 +7,7 @@ import type { MeowFlags } from '../../flags.mts' // differs: reachability is optional on `scan create` and always on for // `scan reach`. export const DYNAMIC_SBOM_INFERENCE_DESCRIPTION = - 'For Gradle, sbt, and Maven: generate a Socket facts SBOM (produced directly by each package manager) per independent build root, instead of one synthetic root.' + 'For Gradle, sbt, Maven and .NET: generate a Socket facts SBOM (produced directly by each package manager) per independent build root, instead of one synthetic root.' export const reachabilityFlags: MeowFlags = { reachVersion: { @@ -154,6 +154,6 @@ export const excludePathsFlag: MeowFlags = { type: 'string', isMultiple: true, description: - 'List of glob patterns to exclude from the scan, including SCA/SBOM manifest discovery and (when --reach is enabled) full application reachability analysis. Patterns are anchored micromatch globs matched relative to the Socket scan root, which is the command working directory (`--cwd` if set), not the reachability target: `tests` matches only `/tests`; use `**/tests` to match at any depth. Negation patterns (`!path`) are not supported. Accepts a comma-separated value or multiple flags. An excluded JVM build module is not analysed as a project of its own, but where a project that is not excluded depends on it, its code is analysed as part of that project. A build module outside the scan root cannot be excluded.', + 'List of glob patterns to exclude from the scan, including SCA/SBOM manifest discovery and (when --reach is enabled) full application reachability analysis. Patterns are anchored micromatch globs matched relative to the Socket scan root, which is the command working directory (`--cwd` if set), not the reachability target: `tests` matches only `/tests`; use `**/tests` to match at any depth. Negation patterns (`!path`) are not supported. Accepts a comma-separated value or multiple flags. An excluded JVM build module or .NET project is not analysed as a project of its own, but where a project that is not excluded depends on it, its code is analysed as part of that project. A build module or project outside the scan root cannot be excluded.', }, } diff --git a/src/commands/scan/run-dynamic-sbom-inference.mts b/src/commands/scan/run-dynamic-sbom-inference.mts index e51fb0b41..5c3b9621f 100644 --- a/src/commands/scan/run-dynamic-sbom-inference.mts +++ b/src/commands/scan/run-dynamic-sbom-inference.mts @@ -52,7 +52,7 @@ export async function runDynamicSbomInference({ if (!outcomes.length) { throw new InputError( [ - 'No Gradle, sbt, or Maven build root was found.', + 'No Gradle, sbt, Maven or .NET build root was found.', '', '- Remove --dynamic-sbom-inference; it only applies to these ecosystems.', '- Make sure to run it from the correct dir (use --cwd to target another dir).', diff --git a/src/commands/scan/run-dynamic-sbom-inference.test.mts b/src/commands/scan/run-dynamic-sbom-inference.test.mts index 92ab9eac0..18d5b6c40 100644 --- a/src/commands/scan/run-dynamic-sbom-inference.test.mts +++ b/src/commands/scan/run-dynamic-sbom-inference.test.mts @@ -97,7 +97,7 @@ describe('runDynamicSbomInference', () => { sbtTmpDir: undefined, withFiles: true, }), - ).rejects.toThrow(/No Gradle, sbt, or Maven build root was found/) + ).rejects.toThrow(/No Gradle, sbt, Maven or .NET build root was found/) }) it('throws when a discovered build root failed to generate facts', async () => { From 3a5f6a606b501b01b1e2ba001c7b642a59874c0d Mon Sep 17 00:00:00 2001 From: Jeppe Fredsgaard Blaabjerg Date: Mon, 2 Nov 2026 11:44:39 +0100 Subject: [PATCH 2/3] docs(manifest): tighten .NET help wording List the build tools in full in the dynamic-SBOM-inference and setup help, call the supported list ecosystems, and clarify the no-project dedup rule. Co-Authored-By: Claude Opus 5.5 --- src/commands/manifest/cmd-manifest-auto.test.mts | 2 +- src/commands/manifest/cmd-manifest-dotnet.test.mts | 2 +- src/commands/manifest/cmd-manifest-dynamic-sbom-inference.mts | 2 +- .../manifest/cmd-manifest-dynamic-sbom-inference.test.mts | 4 ++-- src/commands/manifest/cmd-manifest-gradle.test.mts | 2 +- src/commands/manifest/cmd-manifest-kotlin.test.mts | 2 +- src/commands/manifest/cmd-manifest-maven.test.mts | 2 +- src/commands/manifest/cmd-manifest-scala.test.mts | 2 +- src/commands/manifest/cmd-manifest-setup.mts | 2 +- src/commands/manifest/cmd-manifest-setup.test.mts | 2 +- src/commands/manifest/cmd-manifest.mts | 2 +- src/commands/manifest/cmd-manifest.test.mts | 2 +- src/commands/manifest/scripts/resolution-report-render.mts | 4 ++-- src/commands/scan/cmd-scan-create.test.mts | 2 +- src/commands/scan/cmd-scan-reach.test.mts | 2 +- 15 files changed, 17 insertions(+), 17 deletions(-) diff --git a/src/commands/manifest/cmd-manifest-auto.test.mts b/src/commands/manifest/cmd-manifest-auto.test.mts index a4166d8cb..0df3f5a20 100644 --- a/src/commands/manifest/cmd-manifest-auto.test.mts +++ b/src/commands/manifest/cmd-manifest-auto.test.mts @@ -23,7 +23,7 @@ describe('socket manifest auto', async () => { $ socket manifest auto [options] [CWD=.] Options - --exclude-paths List of glob patterns to exclude from manifest/facts generation. Patterns are anchored micromatch globs matched relative to CWD (\`--cwd\` if set): \`tests\` matches only \`/tests\`; use \`**/tests\` to match at any depth. Negation patterns (\`!path\`) are not supported. Accepts a comma-separated value or multiple flags. An excluded JVM build module or .NET project is not analysed as a project of its own, but where a project that is not excluded depends on it, its code is analysed as part of that project. + --exclude-paths List of glob patterns to exclude from manifest/facts generation. Patterns are anchored micromatch globs matched relative to CWD (\`--cwd\` if set): \`tests\` matches only \`/tests\`; use \`**/tests\` to match at any depth. Negation patterns (\`!path\`) are not supported. Accepts a comma-separated value or multiple flags. An excluded JVM build module or .NET project is not analysed as a project of its own, but where a project that is not excluded depends on it, its code is analysed as part of that project. A build module or project outside CWD cannot be excluded. --verbose Enable debug output (only for auto itself; sub-steps need to have it pre-configured), may help when running into errors Tries to figure out what language your target repo uses. If it finds a diff --git a/src/commands/manifest/cmd-manifest-dotnet.test.mts b/src/commands/manifest/cmd-manifest-dotnet.test.mts index fa120bc05..4e6013ea8 100644 --- a/src/commands/manifest/cmd-manifest-dotnet.test.mts +++ b/src/commands/manifest/cmd-manifest-dotnet.test.mts @@ -25,7 +25,7 @@ describe('socket manifest dotnet', async () => { --bin Location of the dotnet binary to use, default: dotnet on PATH --dotnet-opts Additional options to pass on to \`dotnet restore\`, e.g. \`-p:Configuration=Release --configfile nuget.config\`. MSBuild properties among them also apply to project evaluation --exclude-configs Comma-separated glob patterns; target frameworks matching any pattern are skipped (applied after --include-configs) - --exclude-paths List of glob patterns to exclude from manifest/facts generation. Patterns are anchored micromatch globs matched relative to CWD (\`--cwd\` if set): \`tests\` matches only \`/tests\`; use \`**/tests\` to match at any depth. Negation patterns (\`!path\`) are not supported. Accepts a comma-separated value or multiple flags. An excluded JVM build module or .NET project is not analysed as a project of its own, but where a project that is not excluded depends on it, its code is analysed as part of that project. + --exclude-paths List of glob patterns to exclude from manifest/facts generation. Patterns are anchored micromatch globs matched relative to CWD (\`--cwd\` if set): \`tests\` matches only \`/tests\`; use \`**/tests\` to match at any depth. Negation patterns (\`!path\`) are not supported. Accepts a comma-separated value or multiple flags. An excluded JVM build module or .NET project is not analysed as a project of its own, but where a project that is not excluded depends on it, its code is analysed as part of that project. A build module or project outside CWD cannot be excluded. --ignore-unresolved Warn on unresolved dependencies instead of failing the run (unresolved deps are not emitted to the facts file) --include-configs Comma-separated glob patterns matched against target frameworks (case-sensitive; \`*\`, \`?\`, and \`[...]\` wildcards). Only target frameworks matching at least one pattern are read, e.g. \`net8.0\`. A runtime-specific target (\`net8.0/win-x64\`) also matches its framework. Default: every target framework --verbose Print debug messages diff --git a/src/commands/manifest/cmd-manifest-dynamic-sbom-inference.mts b/src/commands/manifest/cmd-manifest-dynamic-sbom-inference.mts index a36e57b82..054d8b56f 100644 --- a/src/commands/manifest/cmd-manifest-dynamic-sbom-inference.mts +++ b/src/commands/manifest/cmd-manifest-dynamic-sbom-inference.mts @@ -21,7 +21,7 @@ import type { const config: CliCommandConfig = { commandName: 'dynamic-sbom-inference', description: - 'Recursively discover gradle/sbt/maven/dotnet build roots and generate a Socket facts SBOM for each', + 'Recursively discover .NET, Gradle, Maven, and sbt build roots and generate a Socket facts SBOM for each', hidden: false, flags: { ...commonFlags, diff --git a/src/commands/manifest/cmd-manifest-dynamic-sbom-inference.test.mts b/src/commands/manifest/cmd-manifest-dynamic-sbom-inference.test.mts index 3cfe4fffa..93579dcf1 100644 --- a/src/commands/manifest/cmd-manifest-dynamic-sbom-inference.test.mts +++ b/src/commands/manifest/cmd-manifest-dynamic-sbom-inference.test.mts @@ -18,7 +18,7 @@ describe('socket manifest dynamic-sbom-inference', async () => { cwd: testPath, }) expect(stdout).toMatchInlineSnapshot(` - "Recursively discover gradle/sbt/maven/dotnet build roots and generate a Socket facts SBOM for each + "Recursively discover .NET, Gradle, Maven, and sbt build roots and generate a Socket facts SBOM for each Usage $ socket manifest dynamic-sbom-inference [options] [CWD=.] @@ -33,7 +33,7 @@ describe('socket manifest dynamic-sbom-inference', async () => { CWD itself. Options - --exclude-paths List of glob patterns to exclude from manifest/facts generation. Patterns are anchored micromatch globs matched relative to CWD (\`--cwd\` if set): \`tests\` matches only \`/tests\`; use \`**/tests\` to match at any depth. Negation patterns (\`!path\`) are not supported. Accepts a comma-separated value or multiple flags. An excluded JVM build module or .NET project is not analysed as a project of its own, but where a project that is not excluded depends on it, its code is analysed as part of that project. + --exclude-paths List of glob patterns to exclude from manifest/facts generation. Patterns are anchored micromatch globs matched relative to CWD (\`--cwd\` if set): \`tests\` matches only \`/tests\`; use \`**/tests\` to match at any depth. Negation patterns (\`!path\`) are not supported. Accepts a comma-separated value or multiple flags. An excluded JVM build module or .NET project is not analysed as a project of its own, but where a project that is not excluded depends on it, its code is analysed as part of that project. A build module or project outside CWD cannot be excluded. --ignore-unresolved Warn on unresolved dependencies instead of failing the run (unresolved deps are not emitted to the facts files); overrides each build's socket.json setting --json Output as JSON --markdown Output as Markdown diff --git a/src/commands/manifest/cmd-manifest-gradle.test.mts b/src/commands/manifest/cmd-manifest-gradle.test.mts index 7f8124e4c..a0cf554cf 100644 --- a/src/commands/manifest/cmd-manifest-gradle.test.mts +++ b/src/commands/manifest/cmd-manifest-gradle.test.mts @@ -25,7 +25,7 @@ describe('socket manifest gradle', async () => { Options --bin Location of the gradle binary to use, default: ./gradlew if present, else gradle on PATH --exclude-configs When generating facts: comma-separated glob patterns; Gradle configurations matching any pattern are skipped (applied after --include-configs) - --exclude-paths List of glob patterns to exclude from manifest/facts generation. Patterns are anchored micromatch globs matched relative to CWD (\`--cwd\` if set): \`tests\` matches only \`/tests\`; use \`**/tests\` to match at any depth. Negation patterns (\`!path\`) are not supported. Accepts a comma-separated value or multiple flags. An excluded JVM build module or .NET project is not analysed as a project of its own, but where a project that is not excluded depends on it, its code is analysed as part of that project. + --exclude-paths List of glob patterns to exclude from manifest/facts generation. Patterns are anchored micromatch globs matched relative to CWD (\`--cwd\` if set): \`tests\` matches only \`/tests\`; use \`**/tests\` to match at any depth. Negation patterns (\`!path\`) are not supported. Accepts a comma-separated value or multiple flags. An excluded JVM build module or .NET project is not analysed as a project of its own, but where a project that is not excluded depends on it, its code is analysed as part of that project. A build module or project outside CWD cannot be excluded. --facts Emit a Socket facts JSON file (\`gradle.socket.facts.json\`) describing the resolved dependency graph. This is the default; pass \`--pom\` to generate \`pom.xml\` files instead --gradle-opts Additional options to pass on to ./gradlew, see \`./gradlew --help\` --ignore-unresolved When generating facts: warn on unresolved dependencies instead of failing the run (unresolved deps are not emitted to the facts file) diff --git a/src/commands/manifest/cmd-manifest-kotlin.test.mts b/src/commands/manifest/cmd-manifest-kotlin.test.mts index 958fdaf09..c60464838 100644 --- a/src/commands/manifest/cmd-manifest-kotlin.test.mts +++ b/src/commands/manifest/cmd-manifest-kotlin.test.mts @@ -25,7 +25,7 @@ describe('socket manifest kotlin', async () => { Options --bin Location of the gradle binary to use, default: ./gradlew if present, else gradle on PATH --exclude-configs When generating facts: comma-separated glob patterns; Gradle configurations matching any pattern are skipped (applied after --include-configs) - --exclude-paths List of glob patterns to exclude from manifest/facts generation. Patterns are anchored micromatch globs matched relative to CWD (\`--cwd\` if set): \`tests\` matches only \`/tests\`; use \`**/tests\` to match at any depth. Negation patterns (\`!path\`) are not supported. Accepts a comma-separated value or multiple flags. An excluded JVM build module or .NET project is not analysed as a project of its own, but where a project that is not excluded depends on it, its code is analysed as part of that project. + --exclude-paths List of glob patterns to exclude from manifest/facts generation. Patterns are anchored micromatch globs matched relative to CWD (\`--cwd\` if set): \`tests\` matches only \`/tests\`; use \`**/tests\` to match at any depth. Negation patterns (\`!path\`) are not supported. Accepts a comma-separated value or multiple flags. An excluded JVM build module or .NET project is not analysed as a project of its own, but where a project that is not excluded depends on it, its code is analysed as part of that project. A build module or project outside CWD cannot be excluded. --facts Emit a Socket facts JSON file (\`gradle.socket.facts.json\`) describing the resolved dependency graph. This is the default; pass \`--pom\` to generate \`pom.xml\` files instead --gradle-opts Additional options to pass on to ./gradlew, see \`./gradlew --help\` --ignore-unresolved When generating facts: warn on unresolved dependencies instead of failing the run (unresolved deps are not emitted to the facts file) diff --git a/src/commands/manifest/cmd-manifest-maven.test.mts b/src/commands/manifest/cmd-manifest-maven.test.mts index f3f1a51a5..dd6c524bc 100644 --- a/src/commands/manifest/cmd-manifest-maven.test.mts +++ b/src/commands/manifest/cmd-manifest-maven.test.mts @@ -24,7 +24,7 @@ describe('socket manifest maven', async () => { Options --bin Location of the maven binary to use, default: ./mvnw if present, else mvn on PATH --exclude-configs Comma-separated glob patterns; Maven scopes matching any pattern are skipped (applied after --include-configs) - --exclude-paths List of glob patterns to exclude from manifest/facts generation. Patterns are anchored micromatch globs matched relative to CWD (\`--cwd\` if set): \`tests\` matches only \`/tests\`; use \`**/tests\` to match at any depth. Negation patterns (\`!path\`) are not supported. Accepts a comma-separated value or multiple flags. An excluded JVM build module or .NET project is not analysed as a project of its own, but where a project that is not excluded depends on it, its code is analysed as part of that project. + --exclude-paths List of glob patterns to exclude from manifest/facts generation. Patterns are anchored micromatch globs matched relative to CWD (\`--cwd\` if set): \`tests\` matches only \`/tests\`; use \`**/tests\` to match at any depth. Negation patterns (\`!path\`) are not supported. Accepts a comma-separated value or multiple flags. An excluded JVM build module or .NET project is not analysed as a project of its own, but where a project that is not excluded depends on it, its code is analysed as part of that project. A build module or project outside CWD cannot be excluded. --ignore-unresolved Warn on unresolved dependencies instead of failing the run (unresolved deps are not emitted to the facts file) --include-configs Comma-separated glob patterns matched against Maven dependency scopes (case-sensitive; \`*\`, \`?\`, and \`[...]\` wildcards). Only scopes matching at least one pattern are resolved. e.g. \`compile,runtime\`. Default: every scope --maven-opts Additional options to pass on to maven, e.g. \`-P -s \` diff --git a/src/commands/manifest/cmd-manifest-scala.test.mts b/src/commands/manifest/cmd-manifest-scala.test.mts index 251622c70..32678befc 100644 --- a/src/commands/manifest/cmd-manifest-scala.test.mts +++ b/src/commands/manifest/cmd-manifest-scala.test.mts @@ -25,7 +25,7 @@ describe('socket manifest scala', async () => { Options --bin Location of sbt binary to use --exclude-configs When generating facts: comma-separated glob patterns; sbt configurations matching any pattern are skipped (applied after --include-configs) - --exclude-paths List of glob patterns to exclude from manifest/facts generation. Patterns are anchored micromatch globs matched relative to CWD (\`--cwd\` if set): \`tests\` matches only \`/tests\`; use \`**/tests\` to match at any depth. Negation patterns (\`!path\`) are not supported. Accepts a comma-separated value or multiple flags. An excluded JVM build module or .NET project is not analysed as a project of its own, but where a project that is not excluded depends on it, its code is analysed as part of that project. + --exclude-paths List of glob patterns to exclude from manifest/facts generation. Patterns are anchored micromatch globs matched relative to CWD (\`--cwd\` if set): \`tests\` matches only \`/tests\`; use \`**/tests\` to match at any depth. Negation patterns (\`!path\`) are not supported. Accepts a comma-separated value or multiple flags. An excluded JVM build module or .NET project is not analysed as a project of its own, but where a project that is not excluded depends on it, its code is analysed as part of that project. A build module or project outside CWD cannot be excluded. --facts Emit a Socket facts JSON file (\`sbt.socket.facts.json\`) describing the resolved dependency graph. This is the default; pass \`--pom\` to generate \`pom.xml\` files instead --ignore-unresolved When generating facts: warn on unresolved dependencies instead of failing the run (unresolved deps are not emitted to the facts file) --include-configs When generating facts: comma-separated glob patterns matched against sbt configuration names (case-sensitive; \`*\`, \`?\`, and \`[...]\` wildcards). Only configurations matching at least one pattern are resolved. e.g. \`compile,test\`. Default: compile,optional,provided,runtime,test diff --git a/src/commands/manifest/cmd-manifest-setup.mts b/src/commands/manifest/cmd-manifest-setup.mts index 594c7dcf0..626447925 100644 --- a/src/commands/manifest/cmd-manifest-setup.mts +++ b/src/commands/manifest/cmd-manifest-setup.mts @@ -36,7 +36,7 @@ const config: CliCommandConfig = { dynamicSbomInference: { type: 'boolean', description: - 'Generates dynamic SBOMs via the Gradle/sbt/Maven/.NET package manager tools for more accurate results than static resolution. Scans every build root under CWD first, so the configurator only asks about ecosystems actually found; --exclude-paths matches are bulk-disabled, others configured individually.', + 'Uses .NET, Gradle, Maven, and sbt tools to generate dynamic SBOMs with more accurate results than static resolution. It scans build roots under CWD, asks only about detected ecosystems, then disables roots matched by --exclude-paths and configures the rest individually.', }, }, help: (command, config) => ` diff --git a/src/commands/manifest/cmd-manifest-setup.test.mts b/src/commands/manifest/cmd-manifest-setup.test.mts index 2b0b98007..845939d84 100644 --- a/src/commands/manifest/cmd-manifest-setup.test.mts +++ b/src/commands/manifest/cmd-manifest-setup.test.mts @@ -24,7 +24,7 @@ describe('socket manifest setup', async () => { Options --default-on-read-error If reading the socket.json fails, just use a default config? Warning: This might override the existing json file! - --dynamic-sbom-inference Generates dynamic SBOMs via the Gradle/sbt/Maven/.NET package manager tools for more accurate results than static resolution. Scans every build root under CWD first, so the configurator only asks about ecosystems actually found; --exclude-paths matches are bulk-disabled, others configured individually. + --dynamic-sbom-inference Uses .NET, Gradle, Maven, and sbt tools to generate dynamic SBOMs with more accurate results than static resolution. It scans build roots under CWD, asks only about detected ecosystems, then disables roots matched by --exclude-paths and configures the rest individually. --exclude-paths Build roots matching these glob patterns (and everything beneath them) are marked disabled. Patterns are anchored micromatch globs matched relative to CWD: \`legacy\` matches only \`/legacy\`; use \`**/legacy\` to match at any depth. Negation patterns (\`!path\`) are not supported. Accepts a comma-separated value or multiple flags. This command will try to detect all supported ecosystems in given CWD. Then diff --git a/src/commands/manifest/cmd-manifest.mts b/src/commands/manifest/cmd-manifest.mts index 3fbf37081..710a58d5a 100644 --- a/src/commands/manifest/cmd-manifest.mts +++ b/src/commands/manifest/cmd-manifest.mts @@ -41,7 +41,7 @@ const config: CliCommandConfig = { configurations available. See \`manifest --help\` for usage details per language. - Currently supported language: bazel [beta], dotnet [beta], gradle [beta], + Currently supported ecosystems: bazel [beta], dotnet [beta], gradle [beta], kotlin (through gradle) [beta], maven [beta], scala [beta]. Examples diff --git a/src/commands/manifest/cmd-manifest.test.mts b/src/commands/manifest/cmd-manifest.test.mts index 13ee0984e..bdb28fbd4 100644 --- a/src/commands/manifest/cmd-manifest.test.mts +++ b/src/commands/manifest/cmd-manifest.test.mts @@ -28,7 +28,7 @@ describe('socket manifest', async () => { cdxgen Run cdxgen for SBOM generation conda [beta] Convert a Conda environment.yml file to a python requirements.txt dotnet [beta] Generate Socket facts files from .NET solutions and projects - dynamic-sbom-inference Recursively discover gradle/sbt/maven/dotnet build roots and generate a Socket facts SBOM for each + dynamic-sbom-inference Recursively discover .NET, Gradle, Maven, and sbt build roots and generate a Socket facts SBOM for each gradle [beta] Generate a Socket facts file (or \`pom.xml\` with --pom) for a Gradle/Java/Kotlin/etc project kotlin [beta] Generate a Socket facts file (or \`pom.xml\` with --pom) for a Kotlin project maven [beta] Generate a Socket facts file from a Maven \`pom.xml\` project diff --git a/src/commands/manifest/scripts/resolution-report-render.mts b/src/commands/manifest/scripts/resolution-report-render.mts index e3d9bb818..8adc6e2e9 100644 --- a/src/commands/manifest/scripts/resolution-report-render.mts +++ b/src/commands/manifest/scripts/resolution-report-render.mts @@ -88,8 +88,8 @@ const RESOLUTION_REPORT_ARTIFACT_LIMIT = 15 const RESOLUTION_REPORT_CONFIG_LIMIT = 20 // Drop a bare "group:name" when a versioned "group:name:v" of the same module -// failed in the same projects (or, outside any project, also outside one): the -// lenient resolver reports both forms for one failure. +// failed for the same projects, or when both failures have no project. The +// lenient resolver reports both forms for a single failure. function dedupInfos }>( infos: T[], ): T[] { diff --git a/src/commands/scan/cmd-scan-create.test.mts b/src/commands/scan/cmd-scan-create.test.mts index bec426082..65fa85f5f 100644 --- a/src/commands/scan/cmd-scan-create.test.mts +++ b/src/commands/scan/cmd-scan-create.test.mts @@ -105,7 +105,7 @@ describe('socket scan create', async () => { --cwd working directory, defaults to process.cwd() --default-branch Set the default branch of the repository to the branch of this full-scan. Should only need to be done once, for example for the "main" or "master" branch. --dynamic-sbom-inference For Gradle, sbt, Maven and .NET: generate a Socket facts SBOM (produced directly by each package manager) per independent build root, instead of one synthetic root. Combine with --reach to split the reachability analysis per project/module. - --exclude-paths List of glob patterns to exclude from the scan, including SCA/SBOM manifest discovery and (when --reach is enabled) full application reachability analysis. Patterns are anchored micromatch globs matched relative to the Socket scan root, which is the command working directory (\`--cwd\` if set), not the reachability target: \`tests\` matches only \`/tests\`; use \`**/tests\` to match at any depth. Negation patterns (\`!path\`) are not supported. Accepts a comma-separated value or multiple flags. An excluded JVM build module or .NET project is not analysed as a project of its own, but where a project that is not excluded depends on it, its code is analysed as part of that project. + --exclude-paths List of glob patterns to exclude from the scan, including SCA/SBOM manifest discovery and (when --reach is enabled) full application reachability analysis. Patterns are anchored micromatch globs matched relative to the Socket scan root, which is the command working directory (\`--cwd\` if set), not the reachability target: \`tests\` matches only \`/tests\`; use \`**/tests\` to match at any depth. Negation patterns (\`!path\`) are not supported. Accepts a comma-separated value or multiple flags. An excluded JVM build module or .NET project is not analysed as a project of its own, but where a project that is not excluded depends on it, its code is analysed as part of that project. A build module or project outside the scan root cannot be excluded. --interactive Allow for interactive elements, asking for input. Use --no-interactive to prevent any input questions, defaulting them to cancel/no. --json Output as JSON --markdown Output as Markdown diff --git a/src/commands/scan/cmd-scan-reach.test.mts b/src/commands/scan/cmd-scan-reach.test.mts index 347b9c2c3..467d32546 100644 --- a/src/commands/scan/cmd-scan-reach.test.mts +++ b/src/commands/scan/cmd-scan-reach.test.mts @@ -38,7 +38,7 @@ describe('socket scan reach', async () => { Reachability Options --dynamic-sbom-inference For Gradle, sbt, Maven and .NET: generate a Socket facts SBOM (produced directly by each package manager) per independent build root, instead of one synthetic root. The reachability analysis is split per project/module accordingly. - --exclude-paths List of glob patterns to exclude from the scan, including SCA/SBOM manifest discovery and (when --reach is enabled) full application reachability analysis. Patterns are anchored micromatch globs matched relative to the Socket scan root, which is the command working directory (\`--cwd\` if set), not the reachability target: \`tests\` matches only \`/tests\`; use \`**/tests\` to match at any depth. Negation patterns (\`!path\`) are not supported. Accepts a comma-separated value or multiple flags. An excluded JVM build module or .NET project is not analysed as a project of its own, but where a project that is not excluded depends on it, its code is analysed as part of that project. + --exclude-paths List of glob patterns to exclude from the scan, including SCA/SBOM manifest discovery and (when --reach is enabled) full application reachability analysis. Patterns are anchored micromatch globs matched relative to the Socket scan root, which is the command working directory (\`--cwd\` if set), not the reachability target: \`tests\` matches only \`/tests\`; use \`**/tests\` to match at any depth. Negation patterns (\`!path\`) are not supported. Accepts a comma-separated value or multiple flags. An excluded JVM build module or .NET project is not analysed as a project of its own, but where a project that is not excluded depends on it, its code is analysed as part of that project. A build module or project outside the scan root cannot be excluded. --reach-advisories List of advisories to run reachability analysis for, as GHSA or CVE IDs, either as a comma separated value or as multiple flags. CVE IDs are converted to GHSA IDs through the GitHub API. Vulnerabilities from other advisories get unknown reachability. Defaults to all advisories. --reach-analysis-memory-limit The maximum memory for the reachability analysis as a whole number optionally followed by MB or GB (e.g. 512MB, 8GB). The default is 8GB. --reach-analysis-timeout Set the timeout for the reachability analysis as a whole number optionally followed by s, m or h (e.g. 90s, 10m, 1h). Defaults to 10m. Split analysis runs may cause the total scan time to exceed this timeout significantly. From 339065ae2ed770a56c40b590e004483e780d375f Mon Sep 17 00:00:00 2001 From: Jeppe Fredsgaard Blaabjerg Date: Mon, 2 Nov 2026 13:23:07 +0100 Subject: [PATCH 3/3] test(fix): update --help snapshot for the .NET wording Co-Authored-By: Claude Opus 5.5 --- src/commands/fix/cmd-fix.integration.test.mts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/commands/fix/cmd-fix.integration.test.mts b/src/commands/fix/cmd-fix.integration.test.mts index 4293805de..9f9ac3b60 100644 --- a/src/commands/fix/cmd-fix.integration.test.mts +++ b/src/commands/fix/cmd-fix.integration.test.mts @@ -169,7 +169,7 @@ describe('socket fix', async () => { See GitHub documentation (https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/configuring-pull-request-merges/managing-auto-merge-for-pull-requests-in-your-repository) for managing auto-merge for pull requests in your repository. --debug Enable debug logging in the Coana-based Socket Fix CLI invocation. --disable-external-tool-checks Disable external tool checks during fix analysis. - --dynamic-sbom-inference For Gradle, sbt, and Maven: generate a Socket facts SBOM (produced directly by each package manager) per independent build root, instead of one synthetic root. Fixes are then attributed to the projects/modules that actually resolve each vulnerable dependency. The generated files are removed afterwards. + --dynamic-sbom-inference For Gradle, sbt, Maven and .NET: generate a Socket facts SBOM (produced directly by each package manager) per independent build root, instead of one synthetic root. Fixes are then attributed to the projects/modules that actually resolve each vulnerable dependency. The generated files are removed afterwards. --ecosystems Limit fix analysis to specific ecosystems. Accepts space- or comma-separated values and is case-insensitive. Defaults to all ecosystems. --exclude-paths Skip matching paths from the scan entirely: manifests under these paths are not uploaded, and fixes are not applied to workspaces under them. Patterns are anchored micromatch globs matched relative to the target directory (CWD); \`data/postgres/pgdata\` matches that exact path, \`**/pgdata\` matches at any depth. Use this to skip directories the current user cannot read so they do not abort manifest collection. Negation patterns (\`!path\`) are not supported. Accepts a comma-separated value or multiple flags. --fix-version Override the version of @coana-tech/cli used for fix analysis. Default: .