refactor(scan): fail closed without a .NET SDK, simplify facts-only wiring

- --dynamic-sbom-inference and its setup wizard fail closed when no .NET
  SDK runs for a .NET build root, for every consumer, since no facts can
  be generated without it. --auto-manifest still warns and skips.
- Name socket.json's path and the setup command in the next steps.
- Write the reachability sidecar whenever facts-only types are set, so
  the flag and the sidecar `coana run` needs come from the same input.
- Name the upload-only inference mode instead of an undefined consumer.
- Move useOnlySocketFactsArtifactsFlags next to the other Coana helpers.
- Table-driven tests with shared helpers.

Author: jfblaa

CHANGELOG.md

@@ -8,7 +8,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
 ### Changed
 - With `--dynamic-sbom-inference`, reachability analysis and `socket fix` now take the dependencies of every Gradle, sbt, Maven and .NET build they find from Socket facts only, so results no longer depend on which other builds produced facts.
-- With `--dynamic-sbom-inference`, reachability analysis and `socket fix` now stop with clear next steps when a .NET build cannot be read because no .NET SDK is installed, and warn that builds skipped in `socket.json` are left out. Reachability analysis also stops with next steps when no build produced Socket facts.
+- `--dynamic-sbom-inference` and its setup now stop with clear next steps when a .NET build cannot be read because no .NET SDK is installed, instead of skipping it. With it, reachability analysis and `socket fix` warn that builds skipped in `socket.json` are left out, and reachability analysis stops with next steps when no build produced Socket facts.
 
 ## [1.13.1](https://github.com/SocketDev/socket-cli/releases/tag/v1.13.1) - 2026-11-03
 

src/commands/fix/generated-socket-facts.mts

@@ -1,7 +1,7 @@
 import { copyFile, mkdir, rm, writeFile } from 'node:fs/promises'
 import path from 'node:path'
 
-import { useOnlySocketFactsArtifactsFlags } from '../manifest/scripts/sidecar.mts'
+import { useOnlySocketFactsArtifactsFlags } from '../../utils/coana.mts'
 import { runDynamicSbomInference } from '../scan/run-dynamic-sbom-inference.mts'
 
 export type GeneratedSocketFacts = {

src/commands/manifest/generate-recursive-manifests.mts

@@ -18,7 +18,7 @@ import {
   DSI_SETUP_COMMAND,
   REACH_CONTINUE_ON_INSTALL_ERRORS_FLAG,
 } from './scripts/resolution-report-render.mts'
-import { noDotnetSdkReason, skipWithoutDotnetSdk } from './scripts/run.mts'
+import { noDotnetSdkReason } from './scripts/run.mts'
 import { SOCKET_JSON } from '../../constants.mts'
 import { loadSocketConfig } from '../../utils/config.mts'
 import { InputError } from '../../utils/errors.mts'
@@ -45,7 +45,6 @@ export type RecursiveManifestOutcomeStatus =
   | 'generated'
   | 'skippedCovered'
   | 'skippedDisabled'
-  | 'skippedNoSdk'
 
 export type RecursiveManifestOutcome = BuildRoot & {
   ecosystem: BuildTool
@@ -153,7 +152,6 @@ async function runEcosystemCandidates({
   ignoreUnresolved: ignoreUnresolvedOverride,
   optionFlags,
   realCwd,
-  requireDotnetSdk,
   rootSockJson,
   sbtTmpDir,
   sidecarAcc,
@@ -165,7 +163,6 @@ async function runEcosystemCandidates({
   ignoreUnresolved: boolean | undefined
   optionFlags: ReadonlySet<BuildOption>
   realCwd: string
-  requireDotnetSdk: boolean | undefined
   rootSockJson: SocketJson
   // sbt only: a shared global base reused across every sbt root in this run,
   // so sbt's own Scala-toolchain cache under <base>/boot survives between
@@ -215,26 +212,20 @@ async function runEcosystemCandidates({
         outcomes.push({ ...root, ecosystem, status: 'skippedDisabled' })
         continue
       }
-      if (ecosystem === 'dotnet' && requireDotnetSdk) {
+      const socketJson = displayPath(path.join(dir, SOCKET_JSON))
+      if (ecosystem === 'dotnet') {
         // eslint-disable-next-line no-await-in-loop
         const reason = await noDotnetSdkReason(dirConfig.bin, dir)
         if (reason !== undefined) {
           throw new InputError(
             [
-              `No .NET SDK runs for ${displayPath(buildRootPath(root))} (${reason}), so it has no Socket facts, and the analysis takes .NET dependencies only from them.`,
+              `No .NET SDK runs for ${displayPath(buildRootPath(root))} (${reason}), so its Socket facts cannot be generated.`,
               '',
-              '- Install the .NET SDK, or point defaults.manifest.dotnet.bin in socket.json at one.',
-              '- Or leave it out with --exclude-paths, or with defaults.manifest.dotnet.disabled in socket.json.',
+              `- Install the .NET SDK, or point defaults.manifest.dotnet.bin in ${socketJson} at one (\`${DSI_SETUP_COMMAND}\` walks you through it).`,
+              `- Or leave it out with --exclude-paths, or with defaults.manifest.dotnet.disabled in ${socketJson}.`,
             ].join('\n'),
           )
         }
-      } else if (
-        ecosystem === 'dotnet' &&
-        // eslint-disable-next-line no-await-in-loop
-        (await skipWithoutDotnetSdk(dirConfig.bin, dir))
-      ) {
-        outcomes.push({ ...root, ecosystem, status: 'skippedNoSdk' })
-        continue
       }
       // eslint-disable-next-line no-await-in-loop
       const result = await buildUncoveredRoot({
@@ -256,7 +247,7 @@ async function runEcosystemCandidates({
             : undefined,
           flags: optionFlags,
           setupCommand: DSI_SETUP_COMMAND,
-          socketJson: displayPath(path.join(dir, SOCKET_JSON)),
+          socketJson,
         },
         root,
         sidecarAcc,
@@ -371,7 +362,6 @@ export async function generateRecursiveManifests({
   excludePaths,
   ignoreUnresolved,
   optionFlags = new Set(),
-  requireDotnetSdk,
   sbtTmpDir,
   sidecarAcc,
   verbose,
@@ -384,8 +374,6 @@ export async function generateRecursiveManifests({
   // Options the invoking command takes as flags; hints send the rest to each
   // build root's socket.json.
   optionFlags?: ReadonlySet<BuildOption> | undefined
-  // Fail instead of skipping a .NET build root no .NET SDK can build.
-  requireDotnetSdk?: boolean | undefined
   // Reachability path only: caller-supplied directory to use as sbt's shared
   // global base across every sbt root in this run. sbt provisions the Scala
   // toolchain under `<base>/boot`, which withFiles' artifactPaths point into,
@@ -424,7 +412,6 @@ export async function generateRecursiveManifests({
       ignoreUnresolved,
       optionFlags,
       realCwd,
-      requireDotnetSdk,
       rootSockJson,
       sbtTmpDir: resolvedSbtTmpDir,
       sidecarAcc,

src/commands/manifest/generate-recursive-manifests.test.mts

@@ -19,17 +19,12 @@ vi.mock('./scripts/run.mts', async importOriginal => ({
   ...(await importOriginal<typeof import('./scripts/run.mts')>()),
   listDotnetEntryProjects: vi.fn(async () => undefined),
   noDotnetSdkReason: vi.fn(async () => undefined),
-  skipWithoutDotnetSdk: vi.fn(async () => false),
 }))
 
 import { buildRootPath } from './discover-manifest-roots.mts'
 import { generateRecursiveManifests } from './generate-recursive-manifests.mts'
 import { runManifestFacts } from './run-manifest-facts.mts'
-import {
-  listDotnetEntryProjects,
-  noDotnetSdkReason,
-  skipWithoutDotnetSdk,
-} from './scripts/run.mts'
+import { listDotnetEntryProjects, noDotnetSdkReason } from './scripts/run.mts'
 import { testPath } from '../../../test/utils.mts'
 import {
   readOrDefaultSocketJson,
@@ -529,7 +524,7 @@ describe('generateRecursiveManifests', () => {
     })
   })
 
-  it('fails before building anything when a .NET build root needs an SDK that does not run', async () => {
+  it('fails before building anything when no .NET SDK runs for a .NET build root', async () => {
     const dir = await fs.mkdtemp(path.join(tmpdir(), 'dsi-require-sdk-'))
     try {
       await fs.writeFile(path.join(dir, 'pom.xml'), '<project/>')
@@ -540,44 +535,15 @@ describe('generateRecursiveManifests', () => {
       await expect(
         generateRecursiveManifests({
           cwd: dir,
-          requireDotnetSdk: true,
           verbose: false,
         }),
       ).rejects.toThrow(/No .NET SDK runs for .* \(dotnet not found\)/)
-      expect(skipWithoutDotnetSdk).not.toHaveBeenCalled()
       expect(runManifestFacts).not.toHaveBeenCalled()
     } finally {
       await fs.rm(dir, { recursive: true, force: true })
     }
   })
 
-  it('skips .NET builds, without failing, where no .NET SDK runs', async () => {
-    const dir = await fs.mkdtemp(path.join(tmpdir(), 'dsi-no-sdk-'))
-    try {
-      await fs.writeFile(path.join(dir, 'pom.xml'), '<project/>')
-      await fs.mkdir(path.join(dir, 'samples'))
-      await fs.writeFile(path.join(dir, 'samples', 'Stray.csproj'), '')
-      vi.mocked(skipWithoutDotnetSdk).mockResolvedValueOnce(true)
-      vi.mocked(runManifestFacts).mockImplementation(async ({ cwd }) => ({
-        factsPath: path.join(cwd, 'pom.xml.socket.facts.json'),
-        projects: [],
-      }))
-      const outcomes = await generateRecursiveManifests({
-        cwd: dir,
-        verbose: false,
-      })
-
-      expect(
-        outcomes.map(o => `${o.ecosystem}:${o.entryFile}:${o.status}`).sort(),
-      ).toEqual(['dotnet:Stray.csproj:skippedNoSdk', 'maven:pom.xml:generated'])
-      expect(
-        vi.mocked(runManifestFacts).mock.calls.map(([o]) => o.ecosystem),
-      ).toEqual(['maven'])
-    } finally {
-      await fs.rm(dir, { recursive: true, force: true })
-    }
-  })
-
   it("does not list a solution's members for coverage another tool's builds recorded", async () => {
     const dir = await fs.mkdtemp(path.join(tmpdir(), 'dsi-per-tool-'))
     try {

src/commands/manifest/scripts/sidecar.mts

@@ -157,13 +157,3 @@ export function serializeSidecar(
   }
   return result
 }
-
-// Facts-only whether or not any facts were generated. Maven alone keeps the
-// older flag, which Coana releases before 15.14.1 also know.
-export function useOnlySocketFactsArtifactsFlags(
-  types: readonly string[],
-): string[] {
-  return types.length === 1 && types[0] === 'maven'
-    ? ['--maven-use-only-socket-facts']
-    : ['--use-only-socket-facts-artifacts', [...types].sort().join(',')]
-}

src/commands/manifest/scripts/sidecar.test.mts

@@ -6,7 +6,6 @@ import {
   hasSidecarEntries,
   mergeResolvedPathsSidecars,
   serializeSidecar,
-  useOnlySocketFactsArtifactsFlags,
 } from './sidecar.mts'
 
 import type { ResolvedArtifactPaths, SocketFactsSbom } from './facts.mts'
@@ -422,22 +421,3 @@ describe('compute-artifacts sidecar', () => {
     expect(hasResolvedPathsSidecarEntries({})).toBe(false)
   })
 })
-
-describe('useOnlySocketFactsArtifactsFlags', () => {
-  it('keeps the Maven-only flag every Coana release knows for Maven alone', () => {
-    expect(useOnlySocketFactsArtifactsFlags(['maven'])).toEqual([
-      '--maven-use-only-socket-facts',
-    ])
-  })
-
-  it('names every other selection, sorted', () => {
-    expect(useOnlySocketFactsArtifactsFlags(['nuget', 'maven'])).toEqual([
-      '--use-only-socket-facts-artifacts',
-      'maven,nuget',
-    ])
-    expect(useOnlySocketFactsArtifactsFlags(['nuget'])).toEqual([
-      '--use-only-socket-facts-artifacts',
-      'nuget',
-    ])
-  })
-})

src/commands/manifest/setup-recursive-manifest-config.mts

@@ -18,7 +18,7 @@ import {
 } from './discover-manifest-roots.mts'
 import { enumerateWorkspaces } from './enumerate-workspaces.mts'
 import { resolveEcosystemConfig } from './generate-recursive-manifests.mts'
-import { skipWithoutDotnetSdk } from './scripts/run.mts'
+import { noDotnetSdkReason } from './scripts/run.mts'
 import {
   setupDotnet,
   setupGradle,
@@ -241,8 +241,16 @@ export async function markWorkspaceCoverage({
   if (skipReason) {
     return { ok: true, data: undefined }
   }
-  if (ecosystem === 'dotnet' && (await skipWithoutDotnetSdk(bin, dir))) {
-    return { ok: true, data: undefined }
+  if (ecosystem === 'dotnet') {
+    const reason = await noDotnetSdkReason(bin, dir)
+    if (reason !== undefined) {
+      return {
+        ok: false,
+        message: `No .NET SDK runs in ${path.relative(cwd, dir) || '.'} (${reason})`,
+        cause:
+          'Install the .NET SDK, or point defaults.manifest.dotnet.bin at one; or leave the directory out with --exclude-paths.',
+      }
+    }
   }
 
   for (const root of roots) {

src/commands/manifest/setup-recursive-manifest-config.test.mts

@@ -25,6 +25,10 @@ vi.mock('./discover-manifest-roots.mts', async importOriginal => {
 vi.mock('./enumerate-workspaces.mts', () => ({
   enumerateWorkspaces: vi.fn(),
 }))
+vi.mock('./scripts/run.mts', async importOriginal => ({
+  ...(await importOriginal<typeof import('./scripts/run.mts')>()),
+  noDotnetSdkReason: vi.fn(async () => undefined),
+}))
 vi.mock('@socketsecurity/registry/lib/prompts', () => ({
   select: vi.fn(),
 }))
@@ -48,6 +52,7 @@ import {
   findBuildToolCandidates,
 } from './discover-manifest-roots.mts'
 import { enumerateWorkspaces } from './enumerate-workspaces.mts'
+import { noDotnetSdkReason } from './scripts/run.mts'
 import { setupGradle, setupMaven, setupSbt } from './setup-manifest-config.mts'
 import {
   configureCandidate,
@@ -455,6 +460,25 @@ describe('markWorkspaceCoverage', () => {
     expect(covered.size).toBe(0)
   })
 
+  it('fails closed when no .NET SDK runs for a .NET root', async () => {
+    vi.mocked(noDotnetSdkReason).mockResolvedValueOnce('dotnet not found')
+
+    const result = await markWorkspaceCoverage({
+      covered: new Set<string>(),
+      cwd,
+      dir: reactor,
+      ecosystem: 'dotnet',
+      rootSockJson: emptySockJson(),
+      roots: [{ dir: reactor, entryFile: 'App.csproj' }],
+    })
+
+    expect(result).toMatchObject({
+      ok: false,
+      message: 'No .NET SDK runs in reactor (dotnet not found)',
+    })
+    expect(enumerateWorkspaces).not.toHaveBeenCalled()
+  })
+
   it('resolves settings once per directory and skips a POM an earlier one covers', async () => {
     vi.mocked(enumerateWorkspaces).mockResolvedValue({
       buildRoot: reactor,

src/commands/scan/handle-create-new-scan.mts

@@ -162,7 +162,7 @@ async function createNewScan(
   let factsOnlyTypes: PURL_Type[] | undefined
 
   // sbt provisions its Scala toolchain under the directory passed as its
-  // isolated global base; withFiles' artifactPaths point into it, so it must
+  // isolated global base; reach's artifactPaths point into it, so it must
   // stay on disk until the reachability analysis below has consumed those
   // paths. Always allocated (even when unused) to keep this uniform rather
   // than conditional on autoManifest/reach.
@@ -177,11 +177,11 @@ async function createNewScan(
         // one at cwd. This runs on its own, so nothing outside those
         // ecosystems is generated unless --auto-manifest also asked for it.
         const dynamicResult = await runDynamicSbomInference({
-          consumer: reach.runReachabilityAnalysis ? 'reach' : undefined,
+          consumer: reach.runReachabilityAnalysis ? 'reach' : 'upload',
           cwd,
           excludePaths: reach.excludePaths,
           // sbt's Scala toolchain lives under its shared global base;
-          // withFiles' resolved paths point into it, so when reachability
+          // reach's artifactPaths point into it, so when reachability
           // will consume them afterward, reuse manifestTmpDir (kept alive
           // until reach finishes below) instead of letting the call clean
           // its own ephemeral base up before reach ever reads those paths.

src/commands/scan/handle-create-new-scan.test.mts

@@ -391,7 +391,6 @@ describe('handleCreateNewScan excludePaths', () => {
     expect(mockGenerateRecursiveManifests).toHaveBeenCalledWith(
       expect.objectContaining({
         cwd: '/repo',
-        requireDotnetSdk: false,
         sbtTmpDir: undefined,
         withFiles: false,
       }),
@@ -505,7 +504,6 @@ describe('handleCreateNewScan excludePaths', () => {
 
     expect(mockGenerateRecursiveManifests).toHaveBeenCalledWith(
       expect.objectContaining({
-        requireDotnetSdk: true,
         sbtTmpDir: expect.any(String),
         withFiles: true,
       }),