refactor(scan): require a manifests tar hash for reachability analysis

src/commands/ci/handle-ci.mts

@@ -81,7 +81,6 @@ export async function handleCi(autoManifest: boolean): Promise<void> {
       reachEcosystems: [],
       reachEnableAnalysisSplitting: false,
       reachExcludePaths: [],
-      reachLazyMode: false,
       reachRetainFactsFile: false,
       reachSkipCache: false,
       reachUseOnlyPregeneratedSboms: false,

src/commands/scan/cmd-scan-create.mts

@@ -49,6 +49,13 @@ import type {
 
 export const CMD_NAME = 'create'
 
+// Accepted for backwards compatibility but forwarded nowhere, so passing one
+// must not imply --reach.
+const DEPRECATED_NO_OP_REACH_FLAGS = new Set([
+  'reachDisableAnalysisSplitting',
+  'reachLazyMode',
+])
+
 const description = 'Create a new Socket scan and report'
 
 const hidden = false
@@ -270,7 +277,7 @@ async function run(
     reachDisableAnalytics,
     reachDisableExternalToolChecks,
     reachEnableAnalysisSplitting,
-    reachLazyMode,
+    reachLazyMode: _reachLazyMode,
     reachRetainFactsFile,
     reachSkipCache,
     reachUseOnlyPregeneratedSboms,
@@ -518,12 +525,11 @@ async function run(
 
   // Compare every boolean reach flag against its declared default so newly
   // added flags require --reach automatically instead of relying on a
-  // hand-maintained list. The deprecated no-op
-  // --reach-disable-analysis-splitting is excluded on purpose.
+  // hand-maintained list. Deprecated no-ops are excluded on purpose.
   const isUsingAnyBooleanReachFlag = Object.entries(reachabilityFlags).some(
     ([name, flag]) =>
       flag.type === 'boolean' &&
-      name !== 'reachDisableAnalysisSplitting' &&
+      !DEPRECATED_NO_OP_REACH_FLAGS.has(name) &&
       cli.flags[name] !== flag.default,
   )
 
@@ -656,7 +662,6 @@ async function run(
       reachEcosystems,
       reachEnableAnalysisSplitting: Boolean(reachEnableAnalysisSplitting),
       reachExcludePaths,
-      reachLazyMode: Boolean(reachLazyMode),
       reachRetainFactsFile: Boolean(reachRetainFactsFile),
       reachSkipCache: Boolean(reachSkipCache),
       reachUseOnlyPregeneratedSboms: Boolean(reachUseOnlyPregeneratedSboms),

src/commands/scan/cmd-scan-reach.mts

@@ -152,7 +152,7 @@ async function run(
     reachDisableAnalytics,
     reachDisableExternalToolChecks,
     reachEnableAnalysisSplitting,
-    reachLazyMode,
+    reachLazyMode: _reachLazyMode,
     reachRetainFactsFile,
     reachSkipCache,
     reachUseOnlyPregeneratedSboms,
@@ -302,7 +302,6 @@ async function run(
       reachEcosystems,
       reachEnableAnalysisSplitting: Boolean(reachEnableAnalysisSplitting),
       reachExcludePaths,
-      reachLazyMode: Boolean(reachLazyMode),
       reachRetainFactsFile: Boolean(reachRetainFactsFile),
       reachSkipCache: Boolean(reachSkipCache),
       reachUseOnlyPregeneratedSboms: Boolean(reachUseOnlyPregeneratedSboms),

src/commands/scan/create-scan-from-github.mts

@@ -339,7 +339,6 @@ async function scanOneRepo(
       reachEcosystems: [],
       reachEnableAnalysisSplitting: false,
       reachExcludePaths: [],
-      reachLazyMode: false,
       reachRetainFactsFile: false,
       reachSkipCache: false,
       reachUseOnlyPregeneratedSboms: false,

src/commands/scan/exclude-paths.test.mts

@@ -30,7 +30,6 @@ function makeReachOptions(
     reachEcosystems: [],
     reachEnableAnalysisSplitting: false,
     reachExcludePaths: [],
-    reachLazyMode: false,
     reachRetainFactsFile: false,
     reachSkipCache: false,
     reachUseOnlyPregeneratedSboms: false,

src/commands/scan/handle-create-new-scan.test.mts

@@ -108,7 +108,6 @@ function createConfig(
       reachEcosystems: [],
       reachEnableAnalysisSplitting: false,
       reachExcludePaths: [],
-      reachLazyMode: false,
       reachRetainFactsFile: false,
       reachSkipCache: false,
       reachUseOnlyPregeneratedSboms: false,
@@ -409,7 +408,6 @@ describe('handleCreateNewScan excludePaths', () => {
         reachEcosystems: [],
         reachEnableAnalysisSplitting: false,
         reachExcludePaths: ['dist'],
-        reachLazyMode: false,
         reachRetainFactsFile: false,
         reachSkipCache: false,
         reachUseOnlyPregeneratedSboms: false,
@@ -473,7 +471,6 @@ describe('handleCreateNewScan excludePaths', () => {
         reachEcosystems: [],
         reachEnableAnalysisSplitting: false,
         reachExcludePaths: ['node_modules'],
-        reachLazyMode: false,
         reachRetainFactsFile: false,
         reachSkipCache: false,
         reachUseOnlyPregeneratedSboms: false,
@@ -543,7 +540,6 @@ describe('handleCreateNewScan excludePaths', () => {
         reachEcosystems: [],
         reachEnableAnalysisSplitting: false,
         reachExcludePaths: [],
-        reachLazyMode: false,
         reachRetainFactsFile: false,
         reachSkipCache: false,
         reachUseOnlyPregeneratedSboms: false,
@@ -603,7 +599,6 @@ describe('handleCreateNewScan excludePaths', () => {
         reachEcosystems: [],
         reachEnableAnalysisSplitting: false,
         reachExcludePaths: ['node_modules'],
-        reachLazyMode: false,
         reachRetainFactsFile: false,
         reachSkipCache: false,
         reachUseOnlyPregeneratedSboms: false,
@@ -663,7 +658,6 @@ describe('handleCreateNewScan excludePaths', () => {
         reachEcosystems: [],
         reachEnableAnalysisSplitting: false,
         reachExcludePaths: [],
-        reachLazyMode: false,
         reachRetainFactsFile: false,
         reachSkipCache: false,
         reachUseOnlyPregeneratedSboms: false,

src/commands/scan/handle-scan-reach.mts

@@ -137,7 +137,6 @@ async function runScanReach(
     resolvedPathsSidecar,
     spinner,
     target: targets[0]!,
-    uploadManifests: true,
   })
 
   spinner.stop()

src/commands/scan/handle-scan-reach.test.mts

@@ -133,7 +133,6 @@ describe('handleScanReach', () => {
       reachEcosystems: [],
       reachEnableAnalysisSplitting: false,
       reachExcludePaths: ['node_modules'],
-      reachLazyMode: false,
       reachRetainFactsFile: false,
       reachSkipCache: false,
       reachUseOnlyPregeneratedSboms: false,
@@ -186,7 +185,6 @@ describe('handleScanReach', () => {
       reachEcosystems: [],
       reachEnableAnalysisSplitting: false,
       reachExcludePaths: ['node_modules'],
-      reachLazyMode: false,
       reachRetainFactsFile: false,
       reachSkipCache: false,
       reachUseOnlyPregeneratedSboms: false,
@@ -249,7 +247,6 @@ describe('handleScanReach', () => {
       reachEcosystems: [],
       reachEnableAnalysisSplitting: false,
       reachExcludePaths: ['node_modules'],
-      reachLazyMode: false,
       reachRetainFactsFile: false,
       reachSkipCache: false,
       reachUseOnlyPregeneratedSboms: false,
@@ -298,7 +295,6 @@ describe('handleScanReach', () => {
       reachEcosystems: [],
       reachEnableAnalysisSplitting: false,
       reachExcludePaths: [],
-      reachLazyMode: false,
       reachRetainFactsFile: false,
       reachSkipCache: false,
       reachUseOnlyPregeneratedSboms: false,
@@ -351,7 +347,6 @@ describe('handleScanReach', () => {
       reachEcosystems: [],
       reachEnableAnalysisSplitting: false,
       reachExcludePaths: [],
-      reachLazyMode: false,
       reachRetainFactsFile: false,
       reachSkipCache: false,
       reachUseOnlyPregeneratedSboms: false,
@@ -389,7 +384,6 @@ describe('handleScanReach', () => {
       reachEcosystems: [],
       reachEnableAnalysisSplitting: false,
       reachExcludePaths: [],
-      reachLazyMode: false,
       reachRetainFactsFile: false,
       reachSkipCache: false,
       reachUseOnlyPregeneratedSboms: false,
@@ -440,7 +434,6 @@ describe('handleScanReach', () => {
       reachEcosystems: [],
       reachEnableAnalysisSplitting: false,
       reachExcludePaths: [],
-      reachLazyMode: false,
       reachRetainFactsFile: false,
       reachSkipCache: false,
       reachUseOnlyPregeneratedSboms: false,
@@ -494,7 +487,6 @@ describe('handleScanReach', () => {
       reachEcosystems: [],
       reachEnableAnalysisSplitting: false,
       reachExcludePaths: [],
-      reachLazyMode: false,
       reachRetainFactsFile: false,
       reachSkipCache: false,
       reachUseOnlyPregeneratedSboms: false,

src/commands/scan/perform-reachability-analysis.mts

@@ -39,7 +39,6 @@ export type ReachabilityOptions = {
   reachEcosystems: PURL_Type[]
   reachEnableAnalysisSplitting: boolean
   reachExcludePaths: string[]
-  reachLazyMode: boolean
   reachRetainFactsFile: boolean
   reachSkipCache: boolean
   reachUseOnlyPregeneratedSboms: boolean
@@ -49,18 +48,19 @@ export type ReachabilityOptions = {
 export type ReachabilityAnalysisOptions = {
   branchName?: string | undefined
   cwd?: string | undefined
-  orgSlug?: string | undefined
+  // Required: the manifest upload they drive produces the tar hash Coana needs
+  // to run without Docker.
+  orgSlug: string
   outputKind?: OutputKind | undefined
   outputPath?: string | undefined
-  packagePaths?: string[] | undefined
+  packagePaths: string[]
   reachabilityOptions: ReachabilityOptions
   // Resolved-paths sidecar from the auto-manifest run; passed to coana so it
   // reuses these paths instead of re-resolving the build.
   resolvedPathsSidecar?: ResolvedPathsSidecar | undefined
   repoName?: string | undefined
   spinner?: Spinner | undefined
   target: string
-  uploadManifests?: boolean | undefined
 }
 
 export type ReachabilityAnalysisResult = {
@@ -69,7 +69,7 @@ export type ReachabilityAnalysisResult = {
 }
 
 export async function performReachabilityAnalysis(
-  options?: ReachabilityAnalysisOptions | undefined,
+  options: ReachabilityAnalysisOptions,
 ): Promise<CResult<ReachabilityAnalysisResult>> {
   const {
     branchName,
@@ -83,7 +83,6 @@ export async function performReachabilityAnalysis(
     resolvedPathsSidecar,
     spinner,
     target,
-    uploadManifests = true,
   } = { __proto__: null, ...options } as ReachabilityAnalysisOptions
 
   // Determine the analysis target - make it relative to cwd if absolute.
@@ -125,61 +124,58 @@ export async function performReachabilityAnalysis(
 
   const wasSpinning = !!spinner?.isSpinning
 
-  let tarHash: string | undefined
-
-  if (uploadManifests && orgSlug && packagePaths) {
-    // Setup SDK for uploading manifests
-    const sockSdkCResult = await setupSdk()
-    if (!sockSdkCResult.ok) {
-      return sockSdkCResult
-    }
-
-    const sockSdk = sockSdkCResult.data
-
-    spinner?.start('Uploading manifests for reachability analysis...')
+  // Setup SDK for uploading manifests
+  const sockSdkCResult = await setupSdk()
+  if (!sockSdkCResult.ok) {
+    return sockSdkCResult
+  }
 
-    // Ensure uploaded manifest files are relative to analysis target as coana resolves SBOM manifest files relative to this path
-    // NOTE: previously stripped any `.socket.facts.json` from packagePaths
-    // here to avoid uploading leftover post-reachability output. With the
-    // producer flow (`socket manifest gradle --facts`) those files are
-    // legitimate INPUT to compute-artifacts, so we now upload them. Stale
-    // facts files are cleaned up downstream — see the post-success
-    // deletion in handle-create-new-scan.mts.
-    const uploadCResult = await handleApiCall(
-      sockSdk.uploadManifestFiles(orgSlug, packagePaths, {
-        pathsRelativeTo: path.resolve(cwd, analysisTarget),
-      }),
-      {
-        description: 'upload manifests',
-        spinner,
-      },
-    )
+  const sockSdk = sockSdkCResult.data
+
+  spinner?.start('Uploading manifests for reachability analysis...')
+
+  // Ensure uploaded manifest files are relative to analysis target as coana resolves SBOM manifest files relative to this path
+  // NOTE: previously stripped any `.socket.facts.json` from packagePaths
+  // here to avoid uploading leftover post-reachability output. With the
+  // producer flow (`socket manifest gradle --facts`) those files are
+  // legitimate INPUT to compute-artifacts, so we now upload them. Stale
+  // facts files are cleaned up downstream — see the post-success
+  // deletion in handle-create-new-scan.mts.
+  const uploadCResult = await handleApiCall(
+    sockSdk.uploadManifestFiles(orgSlug, packagePaths, {
+      pathsRelativeTo: path.resolve(cwd, analysisTarget),
+    }),
+    {
+      description: 'upload manifests',
+      spinner,
+    },
+  )
 
-    spinner?.stop()
+  spinner?.stop()
 
-    if (!uploadCResult.ok) {
-      if (wasSpinning) {
-        spinner.start()
-      }
-      return uploadCResult
+  if (!uploadCResult.ok) {
+    if (wasSpinning) {
+      spinner.start()
     }
+    return uploadCResult
+  }
 
-    tarHash = (uploadCResult.data as { tarHash?: string })?.tarHash
-    if (!tarHash) {
-      if (wasSpinning) {
-        spinner.start()
-      }
-      return {
-        ok: false,
-        message: 'Failed to get manifest tar hash',
-        cause: 'Server did not return a tar hash for the uploaded manifests',
-      }
+  const tarHash = (uploadCResult.data as { tarHash?: string } | undefined)
+    ?.tarHash
+  if (!tarHash) {
+    if (wasSpinning) {
+      spinner.start()
+    }
+    return {
+      ok: false,
+      message: 'Failed to get manifest tar hash',
+      cause: 'Server did not return a tar hash for the uploaded manifests',
     }
-
-    spinner?.start()
-    spinner?.success(`Manifests uploaded successfully. Tar hash: ${tarHash}`)
   }
 
+  spinner?.start()
+  spinner?.success(`Manifests uploaded successfully. Tar hash: ${tarHash}`)
+
   spinner?.start()
   spinner?.infoAndStop('Running reachability analysis with Coana...')
 
@@ -248,9 +244,9 @@ export async function performReachabilityAnalysis(
     ...(reachabilityOptions.reachEnableAnalysisSplitting
       ? []
       : ['--disable-analysis-splitting']),
-    ...(tarHash
-      ? ['--run-without-docker', '--manifests-tar-hash', tarHash]
-      : []),
+    '--run-without-docker',
+    '--manifests-tar-hash',
+    tarHash,
     // Empty reachEcosystems implies scanning all ecosystems.
     ...(reachabilityOptions.reachEcosystems.length
       ? ['--purl-types', ...reachabilityOptions.reachEcosystems]
@@ -263,7 +259,6 @@ export async function performReachabilityAnalysis(
     ...(reachabilityOptions.dynamicSbomInference
       ? ['--maven-use-only-socket-facts']
       : []),
-    ...(reachabilityOptions.reachLazyMode ? ['--lazy-mode'] : []),
     ...(reachabilityOptions.reachSkipCache ? ['--skip-cache-usage'] : []),
     ...(reachabilityOptions.reachUseOnlyPregeneratedSboms
       ? ['--use-only-pregenerated-sboms']