Log why a new repository couldn't be created

get_repo_info mutes the socketdev logger around the repository lookup
and only restored the level after a successful lookup. This module logs
through the same logger, so when the lookup raised for a repository
that isn't in Socket yet, the "attempting to create it" warning and the
creation error were dropped, and the CLI exited 2 right after file
discovery with nothing logged. A successful create also left logging
muted for the rest of the run.

Restore the level in a finally block, and include the repository, the
HTTP status and, on a 403, a repo:create hint in the creation error.
The SDK keeps only the API's "Insufficient permissions" message and
drops the required scope.

Bump to 2.11.9.

Author: dc-larsen

CHANGELOG.md

@@ -1,5 +1,16 @@
 # Changelog
 
+## 2.11.9
+
+### Fixed: report why a new repository couldn't be created
+
+- When a repository isn't in Socket yet and the API token can't create it, the
+  CLI now logs the failure, the HTTP status, and on a 403 a hint about the
+  `repo:create` scope before exiting `2`. Previously it exited `2` right after
+  file discovery with nothing logged.
+- After the CLI creates a missing repository, its logging is no longer silenced
+  for the rest of the run.
+
 ## 2.11.8
 
 ### Changed: bump pinned Coana CLI to 15.14.0

pyproject.toml

@@ -6,7 +6,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "socketsecurity"
-version = "2.11.8"
+version = "2.11.9"
 requires-python = ">= 3.11"
 license = {"file" = "LICENSE"}
 dependencies = [

socketsecurity/__init__.py

@@ -1,3 +1,3 @@
 __author__ = 'socket.dev'
-__version__ = '2.11.8'
+__version__ = '2.11.9'
 USER_AGENT = f'SocketPythonCLI/{__version__}'

socketsecurity/core/__init__.py

@@ -1505,8 +1505,11 @@ def get_repo_info(self, repo_slug: str, default_branch: str = "socket-default-br
             sdk_logger = logging_std.getLogger("socketdev")
             original_level = sdk_logger.level
             sdk_logger.setLevel(logging_std.CRITICAL)
-            response = self.sdk.repos.repo(self.config.org_slug, repo_slug, use_types=True)
-            sdk_logger.setLevel(original_level)
+            try:
+                response = self.sdk.repos.repo(self.config.org_slug, repo_slug, use_types=True)
+            finally:
+                # This module logs through "socketdev" too, so a failed lookup must not leave it muted.
+                sdk_logger.setLevel(original_level)
             if not response.success:
                 log.error(f"Failed to get repository: {response.status}")
                 # log.error(response.message)
@@ -1530,7 +1533,10 @@ def get_repo_info(self, repo_slug: str, default_branch: str = "socket-default-br
                     return response.data
 
             except APIFailure as e:
-                log.error(f"API failure while creating repository: {e}")
+                status = f" (HTTP {e.status_code})" if e.status_code else ""
+                log.error(f"API failure while creating repository {repo_slug}{status}: {e}")
+                if e.status_code == 403:
+                    log.error("A 403 here usually means the API token is missing the repo:create scope.")
                 sys.exit(2) # Exit here with code 2. Code 1 indicates a successfully-detected security issue.
 
         return response.data

tests/core/test_sdk_methods.py

@@ -1,5 +1,7 @@
+import logging
+
 import pytest
-from socketdev.exceptions import APIFailure
+from socketdev.exceptions import APIAccessDenied, APIFailure, APIResourceNotFound
 from socketdev.fullscans import FullScanParams, FullScanStreamResponse, ScanType
 
 from socketsecurity.config import CliConfig
@@ -44,6 +46,41 @@ def test_get_repo_info(core, mock_sdk_with_responses):
     assert repo_info.id == "f639d6c9-acc3-4d8a-9fb5-2090ad651c7e"
     assert repo_info.head_full_scan_id == "head"
 
+
+def test_get_repo_info_logs_why_repo_creation_failed(core, mock_sdk_with_responses, caplog):
+    """A repo that isn't in Socket yet and can't be created exits 2 with the reason logged"""
+    mock_sdk_with_responses.repos.repo.side_effect = APIResourceNotFound(status_code=404)
+    mock_sdk_with_responses.repos.post.side_effect = APIAccessDenied(
+        "Insufficient permissions", status_code=403
+    )
+
+    with caplog.at_level(logging.INFO, logger="socketdev"), pytest.raises(SystemExit) as exit_info:
+        core.get_repo_info("new-repo")
+
+    assert exit_info.value.code == 2
+    messages = [record.getMessage() for record in caplog.records]
+    assert "Failed to get repository new-repo, attempting to create it" in messages
+    assert any("creating repository new-repo (HTTP 403)" in message for message in messages)
+    assert any("repo:create" in message for message in messages)
+
+
+def test_get_repo_info_restores_log_level_after_creating_repo(
+        core, mock_sdk_with_responses, repo_info_response, caplog
+):
+    """Creating a missing repo must not leave the socketdev logger muted for the rest of the run"""
+    mock_sdk_with_responses.repos.repo.side_effect = [
+        APIResourceNotFound(status_code=404),
+        repo_info_response,
+    ]
+    mock_sdk_with_responses.repos.post.return_value = {"id": "created"}
+
+    with caplog.at_level(logging.INFO, logger="socketdev"):
+        repo_info = core.get_repo_info("new-repo")
+        assert logging.getLogger("socketdev").level == logging.INFO
+
+    assert repo_info.id == "f639d6c9-acc3-4d8a-9fb5-2090ad651c7e"
+
+
 def test_get_head_scan_for_repo(core, mock_sdk_with_responses):
     """Test getting head scan ID for a repository"""
     head_scan_id = core.get_head_scan_for_repo("test")