feat(scan): add --dynamic-sbom-inference-ecosystems to choose which ecosystems use Socket facts

scan create, scan reach and fix take purl types (maven covers Gradle, sbt
and Maven; nuget covers .NET). Build tools of unselected types are not
discovered, so their manifest files are used as they are and Coana does not
treat them as facts-only; with --auto-manifest, auto-generation still runs
for them at cwd.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Author: jfblaa

CHANGELOG.md

@@ -6,6 +6,9 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
 ## [Unreleased]
 
+### Added
+- Choose which ecosystems `--dynamic-sbom-inference` covers with `--dynamic-sbom-inference-ecosystems` (`maven` for Gradle, sbt and Maven; `nuget` for .NET) on `socket scan create`, `socket scan reach` and `socket fix`. Ecosystems left out keep their manifest files as they are.
+
 ### Changed
 - With `--dynamic-sbom-inference`, reachability analysis and `socket fix` now take the dependencies of every Gradle, sbt, Maven and .NET build they find from Socket facts only, so results no longer depend on which other builds produced facts.
 - With `--dynamic-sbom-inference`, reachability analysis and `socket fix` now stop with clear next steps when a .NET build cannot be read because no .NET SDK is installed, and warn that builds skipped in `socket.json` are left out. Reachability analysis also stops with next steps when no build produced Socket facts.

src/commands/ci/handle-ci.mts

@@ -10,6 +10,7 @@ import {
   gitBranch,
 } from '../../utils/git.mts'
 import { serializeResultJson } from '../../utils/serialize-result-json.mts'
+import { FACTS_PURL_TYPES } from '../manifest/scripts/build-tool.mts'
 import { handleCreateNewScan } from '../scan/handle-create-new-scan.mts'
 
 /**
@@ -66,6 +67,7 @@ export async function handleCi(autoManifest: boolean): Promise<void> {
     pullRequest: detectCiPullRequestNumber(),
     reach: {
       dynamicSbomInference: false,
+      dynamicSbomInferenceEcosystems: FACTS_PURL_TYPES,
       excludePaths: [],
       reachAdvisories: [],
       reachAnalysisMemoryLimit: '',

src/commands/fix/cmd-fix.integration.test.mts

@@ -170,6 +170,7 @@ describe('socket fix', async () => {
             --debug             Enable debug logging in the Coana-based Socket Fix CLI invocation.
             --disable-external-tool-checks  Disable external tool checks during fix analysis.
             --dynamic-sbom-inference  For Gradle, sbt, Maven and .NET: generate a Socket facts SBOM (produced directly by each package manager) per independent build root, instead of one synthetic root. Fixes are then attributed to the projects/modules that actually resolve each vulnerable dependency. The generated files are removed afterwards.
+            --dynamic-sbom-inference-ecosystems  With --dynamic-sbom-inference: generate Socket facts only for these ecosystems, as either a comma separated value or as multiple flags; the others keep their manifest files as they are. Supported: maven (Gradle, sbt and Maven) and nuget (.NET). Defaults to both.
             --ecosystems        Limit fix analysis to specific ecosystems. Accepts space- or comma-separated values and is case-insensitive. Defaults to all ecosystems.
             --exclude-paths     Skip matching paths from the scan entirely: manifests under these paths are not uploaded, and fixes are not applied to workspaces under them. Patterns are anchored micromatch globs matched relative to the target directory (CWD); \`data/postgres/pgdata\` matches that exact path, \`**/pgdata\` matches at any depth. Use this to skip directories the current user cannot read so they do not abort manifest collection. Negation patterns (\`!path\`) are not supported. Accepts a comma-separated value or multiple flags.
             --fix-version       Override the version of @coana-tech/cli used for fix analysis. Default: <coana-version>.

src/commands/fix/cmd-fix.mts

@@ -33,7 +33,11 @@ import {
 import { RangeStyles } from '../../utils/semver.mts'
 import { getDefaultOrgSlug } from '../ci/fetch-default-org-slug.mts'
 import { assertValidExcludePaths } from '../scan/exclude-paths.mts'
-import { DYNAMIC_SBOM_INFERENCE_DESCRIPTION } from '../scan/reachability-flags.mts'
+import {
+  DYNAMIC_SBOM_INFERENCE_DESCRIPTION,
+  dynamicSbomInferenceEcosystemsFlags,
+  parseDynamicSbomInferenceEcosystems,
+} from '../scan/reachability-flags.mts'
 
 import type { MeowFlag, MeowFlags } from '../../flags.mts'
 import type { PURL_Type } from '../../utils/ecosystem.mts'
@@ -190,6 +194,7 @@ Available styles:
     default: false,
     description: `${DYNAMIC_SBOM_INFERENCE_DESCRIPTION} Fixes are then attributed to the projects/modules that actually resolve each vulnerable dependency. The generated files are removed afterwards.`,
   },
+  ...dynamicSbomInferenceEcosystemsFlags,
   ecosystems: {
     type: 'string',
     default: [],
@@ -398,6 +403,13 @@ async function run(
 
   const outputKind = getOutputKind(json, markdown)
 
+  const dynamicSbomInferenceEcosystemsRaw = cmdFlagValueToArray(
+    cli.flags['dynamicSbomInferenceEcosystems'],
+  )
+  const dynamicSbomInferenceEcosystems = parseDynamicSbomInferenceEcosystems(
+    dynamicSbomInferenceEcosystemsRaw,
+  )
+
   // Process comma-separated values for ecosystems flag.
   // ALL_ECOSYSTEMS is lowercase, so normalize input for a case-insensitive
   // match (mirrors --package-managers behavior).
@@ -446,6 +458,13 @@ async function run(
 
   const wasValidInput = checkCommandInput(
     outputKind,
+    {
+      nook: true,
+      test: dynamicSbomInference || !dynamicSbomInferenceEcosystemsRaw.length,
+      message:
+        '--dynamic-sbom-inference-ecosystems requires --dynamic-sbom-inference',
+      fail: 'add --dynamic-sbom-inference',
+    },
     {
       test: RangeStyles.includes(rangeStyle),
       message: `Expecting range style of ${joinOr(RangeStyles)}`,
@@ -538,6 +557,7 @@ async function run(
     disableExternalToolChecks,
     disableMajorUpdates,
     dynamicSbomInference,
+    dynamicSbomInferenceEcosystems,
     ecosystems: validatedEcosystems,
     exclude: excludePatterns,
     excludePaths: excludePathsPatterns,

src/commands/fix/coana-fix-dynamic-sbom-inference.test.mts

@@ -103,6 +103,7 @@ describe('socket fix --dynamic-sbom-inference', () => {
     disableExternalToolChecks: false,
     disableMajorUpdates: false,
     dynamicSbomInference: true,
+    dynamicSbomInferenceEcosystems: ['maven'],
     ecosystems: [],
     exclude: [],
     excludePaths: [],
@@ -147,6 +148,9 @@ describe('socket fix --dynamic-sbom-inference', () => {
     const result = await coanaFix(baseConfig)
 
     expect(result.ok).toBe(true)
+    expect(mockGenerateSocketFactsForFix).toHaveBeenCalledWith(
+      expect.objectContaining({ purlTypes: ['maven'] }),
+    )
     expect(uploadManifestFiles).toHaveBeenCalledWith(
       'test-org',
       ['/test/cwd/app/build.gradle', FACTS],

src/commands/fix/coana-fix.mts

@@ -391,13 +391,12 @@ async function coanaFixWithFacts(
   if (factsSlot) {
     if (!silence) {
       spinner?.stop()
-      logger.info(
-        'Generating Socket facts for .NET, Gradle, sbt and Maven builds ...',
-      )
+      logger.info('Generating Socket facts for each build ...')
     }
     factsSlot.generated = await generateSocketFactsForFix({
       cwd,
       excludePaths,
+      purlTypes: fixConfig.dynamicSbomInferenceEcosystems,
       findFactsPaths: async () =>
         (await findScanFilepaths()).filter(isSocketFactsFile),
       tmpDir: factsSlot.tmpDir,

src/commands/fix/generated-socket-facts.mts

@@ -4,6 +4,8 @@ import path from 'node:path'
 import { useOnlySocketFactsArtifactsFlags } from '../manifest/scripts/sidecar.mts'
 import { runDynamicSbomInference } from '../scan/run-dynamic-sbom-inference.mts'
 
+import type { PURL_Type } from '../../utils/ecosystem.mts'
+
 export type GeneratedSocketFacts = {
   // Coana's flags selecting what the facts files resolve.
   artifactsFlags: string[]
@@ -39,11 +41,13 @@ export async function generateSocketFactsForFix({
   cwd,
   excludePaths,
   findFactsPaths,
+  purlTypes,
   tmpDir,
 }: {
   cwd: string
   excludePaths: string[]
   findFactsPaths: () => Promise<string[]>
+  purlTypes: readonly PURL_Type[]
   tmpDir: string
 }): Promise<GeneratedSocketFacts> {
   const existingPaths = await findFactsPaths()
@@ -64,6 +68,7 @@ export async function generateSocketFactsForFix({
         consumer: 'fix',
         cwd,
         excludePaths,
+        purlTypes,
         sbtTmpDir: undefined,
       })
     artifactsFlags = useOnlySocketFactsArtifactsFlags(factsOnlyTypes)

src/commands/fix/generated-socket-facts.test.mts

@@ -37,6 +37,7 @@ describe('generateSocketFactsForFix', () => {
       cwd,
       excludePaths: [],
       findFactsPaths: async () => [existing, fresh].filter(p => existsSync(p)),
+      purlTypes: ['maven'],
       tmpDir,
     })
   }
@@ -75,7 +76,7 @@ describe('generateSocketFactsForFix', () => {
     const { artifactsFlags, sidecarFile } = await generate()
 
     expect(mockRunDynamicSbomInference).toHaveBeenCalledWith(
-      expect.objectContaining({ consumer: 'fix' }),
+      expect.objectContaining({ consumer: 'fix', purlTypes: ['maven'] }),
     )
     expect(artifactsFlags).toEqual([
       '--use-only-socket-facts-artifacts',

src/commands/fix/handle-fix.mts

@@ -69,6 +69,7 @@ export async function handleFix({
   disableExternalToolChecks,
   disableMajorUpdates,
   dynamicSbomInference,
+  dynamicSbomInferenceEcosystems,
   ecosystems,
   exclude,
   excludePaths,
@@ -100,6 +101,7 @@ export async function handleFix({
     disableExternalToolChecks,
     disableMajorUpdates,
     dynamicSbomInference,
+    dynamicSbomInferenceEcosystems,
     ecosystems,
     exclude,
     excludePaths,
@@ -130,6 +132,7 @@ export async function handleFix({
       disableExternalToolChecks,
       disableMajorUpdates,
       dynamicSbomInference,
+      dynamicSbomInferenceEcosystems,
       ecosystems,
       exclude,
       excludePaths,

src/commands/fix/types.mts

@@ -13,6 +13,7 @@ export type FixConfig = {
   disableExternalToolChecks: boolean
   disableMajorUpdates: boolean
   dynamicSbomInference: boolean
+  dynamicSbomInferenceEcosystems: readonly PURL_Type[]
   ecosystems: PURL_Type[]
   exclude: string[]
   excludePaths: string[]