GV

GeezerVison

The World Wide Web, restored to 800 pixels of glory.

Home|About|Gaming cabinet|Archives|How it works|Starter sites

On this site

  • Sign in
  • ActionsCI/CD and automation
  • CodespacesCloud development environments
  • All Features
  • Documentation
  • Training
  • Certifications
  • Build with Copilot
  • Customize Copilot
  • Integrations
  • Trending repos
  • GitHub Sponsors
  • Developer articles
  • Enterprises

This view

  • Original page
  • New address

GeezerVison is showing github.com — Raise failure on SBOM fetch errors by lelia · Pull Request #288 · SocketDev/socket-python-cli

Conversation

@lelia

@lelia lelia commented Aug 5, 2026 •
edited
Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link
Copy Markdown
Contributor

Summary

When the full-scan SBOM stream fetch failed, Core.get_sbom_data logged at debug level and returned {}, so report generation continued and produced empty GitLab dependency-scanning, license, and SARIF output with exit code 0. The most common trigger was SocketDev/socket-sdk-python#101: a single artifact with a purl type the SDK didn't recognize (e.g. generic) failed the whole stream parse. That parse fix shipped in socketdev 3.4.2 and is covered by the socketdev==3.5.0 pin already on main; this PR fixes the CLI-side failure handling.

Changes

  • Core.get_sbom_data now logs at error level and raises APIFailure when the stream fetch fails, so the run goes through the existing API-error handling (exit code 3 by default; --disable-blocking still exits 0) instead of emitting empty reports
  • Version 2.6.2 with a changelog entry

Testing

  • New regression test test_get_sbom_data_failure_raises
  • pytest tests/unit tests/core against socketdev 3.5.0: 421 passed, 2 skipped (pre-existing)
  • Validated against the published SDK end to end: live full-scan stream fetch through Core.get_sbom_data, a stream containing a generic artifact flowing through package processing with alerts intact, and the failure path raising instead of writing empty reports

Fixes CE-362
Refs CE-360


Note

Low Risk
Narrow change to error handling on an already-failed SBOM fetch; success paths unchanged and behavior improves CI signal by avoiding silent empty reports.

Overview
SBOM stream failures now fail the run instead of writing empty reports. When Core.get_sbom_data gets success: false from the full-scan stream API, it logs at error and raises APIFailure instead of returning {}. Report generation no longer continues with blank GitLab dependency-scanning, license, and SARIF output and exit code 0; the failure follows existing CLI API-error handling (default exit 3, --disable-blocking still exits 0).

Release 2.6.2 updates version metadata and changelog. A regression test asserts the raise path. The changelog notes the common parse failure (e.g. unrecognized generic purls) is addressed in socketdev 3.4.2+, already pinned at 3.5.0 on main—this PR is the CLI-side handling fix.

Reviewed by Cursor Bugbot for commit f9a4831. Configure here.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

All reactions
@lelia
lelia had a problem deploying to socket-firewall August 5, 2026 16:57 — with GitHub Actions Failure
@lelia lelia changed the title Raise on SBOM fetch failure and require socketdev 3.4.0 (CE-362) Raise on SBOM fetch failure and require socketdev 3.4.0 Aug 5, 2026
@lelia
lelia had a problem deploying to socket-firewall August 5, 2026 20:40 — with GitHub Actions Failure
@lelia
lelia marked this pull request as ready for review August 5, 2026 20:50
@lelia
lelia requested a review from a team as a code owner August 5, 2026 20:50
@lelia
lelia had a problem deploying to socket-firewall August 5, 2026 20:50 — with GitHub Actions Failure
@lelia lelia changed the title Raise on SBOM fetch failure and require socketdev 3.4.0 Raise on SBOM fetch failure and require socketdev 3.4.2 Aug 5, 2026
@lelia @claude
fix(core): raise on SBOM fetch failure instead of writing empty repor…
77b18a7
…ts (CE-362)

get_sbom_data returned {} when the full-scan stream fetch failed, so
report generation continued and produced empty GitLab dependency
scanning, license, and SARIF output with exit code 0. Raise APIFailure
instead so the failure goes through the CLI's existing API-error
handling (exit code 3 by default, still exit 0 with
--disable-blocking).

Bump the socketdev floor to 3.4.2, the bundled release that adds the
missing purl types (e.g. "generic") and per-artifact parse resilience
that caused this failure mode. Merge after socketdev 3.4.2 is on PyPI.

Co-Authored-By: Claude Fable 5 <[email protected]>
@lelia
lelia force-pushed the lelia/generic-purl-type-parse-bug branch from 7ff5db0 to 77b18a7 Compare August 5, 2026 20:52
@lelia
lelia had a problem deploying to socket-firewall August 5, 2026 20:53 — with GitHub Actions Failure
@lelia

lelia commented Aug 5, 2026

Copy link
Copy Markdown
Contributor Author

bugbot run

cursor[bot] reacted with thumbs up emoji
All reactions
  • 👍 1 reaction

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

cursor[bot]
cursor Bot reviewed Aug 5, 2026
View reviewed changes

@cursor cursor Bot left a comment

Copy link
Copy Markdown

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

Reviewed by Cursor Bugbot for commit 77b18a7. Configure here.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

All reactions
@lelia @claude
chore: lock socketdev 3.4.2
648fd41
Co-Authored-By: Claude Fable 5 <[email protected]>
@lelia
lelia temporarily deployed to socket-firewall August 6, 2026 02:21 — with GitHub Actions Inactive
@lelia @claude
chore: bump version to 2.5.11
1fb2f7e
Co-Authored-By: Claude Fable 5 <[email protected]>
@lelia
lelia temporarily deployed to socket-firewall August 6, 2026 02:27 — with GitHub Actions Inactive
@lelia
Merge branch 'main' into lelia/generic-purl-type-parse-bug
7fe46ff
@lelia
lelia temporarily deployed to socket-firewall August 6, 2026 02:34 — with GitHub Actions Inactive
lelia and others added 2 commits August 5, 2026 23:00
@lelia @claude
ci(e2e): retry reachability on empty results, upload diagnostics on f…
18e51b0
…ailure

The e2e-reachability job intermittently fails with 'no components with
alerts in .socket.facts.json': the tier-1 reachability backend can
return empty results while the CLI reports success (ENG-5093), and the
same flake has hit unrelated PRs.

- Add a retry-probe hook to the e2e matrix: entries that define it get
  up to 3 scan attempts, retrying only when the probe says the output
  looks incomplete. Persistent failures still fail via the validate
  step. Each retry emits a warning annotation and a step-summary line
  so flake frequency stays visible.
- Add tests/e2e/reach-facts-probe.sh: exits 0 when the facts file has
  alerted components, non-zero (retry) when empty or missing.
- Upload /tmp/e2e-output.log, SARIF/GitLab outputs, and facts files as
  artifacts when any e2e job fails, so flakes are diagnosable without
  a re-run.

Also bump version to 2.6.2 (2.6.0 and 2.6.1 are being released ahead
of this PR).

Co-Authored-By: Claude Fable 5 <[email protected]>
@lelia
Merge branch 'lelia/generic-purl-type-parse-bug' of github.com:Socket…
d0c5648
…Dev/socket-python-cli into lelia/generic-purl-type-parse-bug
@lelia
lelia temporarily deployed to socket-firewall August 6, 2026 03:01 — with GitHub Actions Inactive
@lelia

lelia commented Aug 6, 2026

Copy link
Copy Markdown
Contributor Author

bugbot run

cursor[bot] reacted with thumbs up emoji
All reactions
  • 👍 1 reaction

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

cursor[bot]
cursor Bot reviewed Aug 6, 2026
View reviewed changes

@cursor cursor Bot left a comment

Copy link
Copy Markdown

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

Reviewed by Cursor Bugbot for commit d0c5648. Configure here.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

All reactions
@lelia lelia mentioned this pull request Aug 6, 2026
Fix intermittent connection resets on scan comparison by polling the diff-scans endpoints #284
Merged
@lelia @claude
chore: require socketdev 3.5.0
8141b48
Co-Authored-By: Claude Fable 5 <[email protected]>
@lelia lelia changed the title Raise on SBOM fetch failure and require socketdev 3.4.2 Raise on SBOM fetch failure and require socketdev 3.5.0 Aug 6, 2026
@lelia
lelia temporarily deployed to socket-firewall August 6, 2026 03:51 — with GitHub Actions Inactive
@lelia lelia mentioned this pull request Aug 6, 2026
Pin all Python dependencies #289
Merged
@lelia @claude
Drop ticket references from e2e comments and note the retry hardening…
f7d5ab0
… in the changelog

Co-Authored-By: Claude Fable 5 <[email protected]>
Signed-off-by: lelia <[email protected]>
@lelia
lelia temporarily deployed to socket-firewall August 6, 2026 04:10 — with GitHub Actions Inactive
@lelia @claude
Move e2e retry changelog entry out and drop remaining ticket reference
e3e0f30
The e2e retry hardening ships with the dependency pinning PR instead,
so its changelog entry moves there.

Co-Authored-By: Claude Fable 5 <[email protected]>
Signed-off-by: lelia <[email protected]>
@lelia
lelia temporarily deployed to socket-firewall August 6, 2026 04:14 — with GitHub Actions Inactive
lelia added 2 commits August 6, 2026 00:24
@lelia
Merge remote-tracking branch 'origin/main' into lelia/generic-purl-ty…
efff937
…pe-parse-bug

# Conflicts:
#	.github/workflows/e2e-test.yml
#	CHANGELOG.md
#	pyproject.toml
#	socketsecurity/__init__.py
#	uv.lock
@lelia
Merge branch 'lelia/generic-purl-type-parse-bug' of github.com:Socket…
f9a4831
…Dev/socket-python-cli into lelia/generic-purl-type-parse-bug

# Conflicts:
#	CHANGELOG.md
@lelia
lelia temporarily deployed to socket-firewall August 6, 2026 04:26 — with GitHub Actions Inactive
@lelia lelia changed the title Raise on SBOM fetch failure and require socketdev 3.5.0 Raise failure on SBOM fetch errors Aug 6, 2026
@lelia lelia changed the title Raise failure on SBOM fetch errors Raise on SBOM fetch failures (SDK >=3.5.0) Aug 6, 2026
@lelia

lelia commented Aug 6, 2026

Copy link
Copy Markdown
Contributor Author

bugbot run

cursor[bot] reacted with thumbs up emoji
All reactions
  • 👍 1 reaction

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

cursor[bot]
cursor Bot reviewed Aug 6, 2026
View reviewed changes

@cursor cursor Bot left a comment

Copy link
Copy Markdown

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

Reviewed by Cursor Bugbot for commit f9a4831. Configure here.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

lelia reacted with hooray emoji
All reactions
  • 🎉 1 reaction
@lelia lelia changed the title Raise on SBOM fetch failures (SDK >=3.5.0) Raise failure on SBOM fetch errors Aug 6, 2026
dacoburn
Douglas (dacoburn) approved these changes Aug 6, 2026
View reviewed changes
@lelia
Merge remote-tracking branch 'origin/main' into lelia/generic-purl-ty…
ca81c16
…pe-parse-bug

# Conflicts:
#	CHANGELOG.md
#	pyproject.toml
#	socketsecurity/__init__.py
#	uv.lock
@lelia
lelia temporarily deployed to socket-firewall August 6, 2026 19:21 — with GitHub Actions Inactive
@lelia @claude
docs: changelog phrasing tweak
079fe87
Co-Authored-By: Claude Fable 5 <[email protected]>
@lelia
lelia force-pushed the lelia/generic-purl-type-parse-bug branch from 079fe87 to ca81c16 Compare August 6, 2026 21:19
@lelia lelia closed this Aug 6, 2026
@lelia lelia reopened this Aug 6, 2026
@lelia lelia closed this Aug 6, 2026
@lelia lelia reopened this Aug 6, 2026
@lelia lelia closed this Aug 6, 2026
@lelia lelia reopened this Aug 6, 2026
@lelia lelia closed this Aug 6, 2026
@lelia lelia reopened this Aug 6, 2026
@lelia lelia closed this Aug 6, 2026
@lelia lelia reopened this Aug 6, 2026
@lelia
lelia temporarily deployed to socket-firewall August 6, 2026 22:58 — with GitHub Actions Inactive
@lelia
lelia temporarily deployed to socket-firewall August 6, 2026 23:00 — with GitHub Actions Inactive
@lelia
lelia temporarily deployed to socket-firewall August 6, 2026 23:07 — with GitHub Actions Inactive
@lelia
lelia merged commit 29bbc56 into main Aug 7, 2026
67 checks passed

Uh oh!

There was an error while loading. Please reload this page.

@lelia lelia mentioned this pull request Aug 7, 2026
Bump pinned @coana-tech/cli to 15.10.4 #291
Merged

This branch was previously deployed

1 inactive deployment
socket-firewall — 079fe878 Deployed Aug 6, 2026 by lelia via python-sfw-smoke-enterprise #237
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@cursor cursor[bot] cursor[bot] left review comments
@dacoburn Douglas (dacoburn) dacoburn approved these changes

Uh oh!

There was an error while loading. Please reload this page.

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Uh oh!

There was an error while loading. Please reload this page.

2 participants

@lelia @dacoburn
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
You are visitor 01402520 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.