GeezerVison is showing github.com — Raise failure on SBOM fetch errors by lelia · Pull Request #288 · SocketDev/socket-python-cli
Conversation
lelia
commented
Aug 5, 2026
•
edited
Loading
Uh oh!
There was an error while loading. Please reload this page.
Summary
When the full-scan SBOM stream fetch failed, Core.get_sbom_data logged at debug level and returned {}, so report generation continued and produced empty GitLab dependency-scanning, license, and SARIF output with exit code 0. The most common trigger was SocketDev/socket-sdk-python#101: a single artifact with a purl type the SDK didn't recognize (e.g. generic) failed the whole stream parse. That parse fix shipped in socketdev 3.4.2 and is covered by the socketdev==3.5.0 pin already on main; this PR fixes the CLI-side failure handling.
Changes
Core.get_sbom_data now logs at error level and raises APIFailure when the stream fetch fails, so the run goes through the existing API-error handling (exit code 3 by default; --disable-blocking still exits 0) instead of emitting empty reports
- Version 2.6.2 with a changelog entry
Testing
- New regression test
test_get_sbom_data_failure_raises
pytest tests/unit tests/core against socketdev 3.5.0: 421 passed, 2 skipped (pre-existing)
- Validated against the published SDK end to end: live full-scan stream fetch through
Core.get_sbom_data, a stream containing a generic artifact flowing through package processing with alerts intact, and the failure path raising instead of writing empty reports
Fixes CE-362
Refs CE-360
Note Low Risk
Narrow change to error handling on an already-failed SBOM fetch; success paths unchanged and behavior improves CI signal by avoiding silent empty reports.
Overview
SBOM stream failures now fail the run instead of writing empty reports. When Core.get_sbom_data gets success: false from the full-scan stream API, it logs at error and raises APIFailure instead of returning {}. Report generation no longer continues with blank GitLab dependency-scanning, license, and SARIF output and exit code 0; the failure follows existing CLI API-error handling (default exit 3, --disable-blocking still exits 0).
Release 2.6.2 updates version metadata and changelog. A regression test asserts the raise path. The changelog notes the common parse failure (e.g. unrecognized generic purls) is addressed in socketdev 3.4.2+, already pinned at 3.5.0 on main—this PR is the CLI-side handling fix.
Reviewed by Cursor Bugbot for commit f9a4831. Configure here.
Sorry, something went wrong.
Uh oh!
There was an error while loading. Please reload this page.
lelia
changed the title
Raise on SBOM fetch failure and require socketdev 3.4.0 (CE-362)
Raise on SBOM fetch failure and require socketdev 3.4.0
Aug 5, 2026
lelia
changed the title
Raise on SBOM fetch failure and require socketdev 3.4.0
Raise on SBOM fetch failure and require socketdev 3.4.2
Aug 5, 2026
…ts (CE-362)
get_sbom_data returned {} when the full-scan stream fetch failed, so
report generation continued and produced empty GitLab dependency
scanning, license, and SARIF output with exit code 0. Raise APIFailure
instead so the failure goes through the CLI's existing API-error
handling (exit code 3 by default, still exit 0 with
--disable-blocking).
Bump the socketdev floor to 3.4.2, the bundled release that adds the
missing purl types (e.g. "generic") and per-artifact parse resilience
that caused this failure mode. Merge after socketdev 3.4.2 is on PyPI.
Co-Authored-By: Claude Fable 5 <[email protected]>
cursor[bot] reacted with thumbs up emoji
Sorry, something went wrong.
Uh oh!
There was an error while loading. Please reload this page.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
✅ Bugbot reviewed your changes and found no new issues!
Comment @cursor review or bugbot run to trigger another review on this PR
Reviewed by Cursor Bugbot for commit 77b18a7. Configure here.
Sorry, something went wrong.
Uh oh!
There was an error while loading. Please reload this page.
…ailure
The e2e-reachability job intermittently fails with 'no components with
alerts in .socket.facts.json': the tier-1 reachability backend can
return empty results while the CLI reports success (ENG-5093), and the
same flake has hit unrelated PRs.
- Add a retry-probe hook to the e2e matrix: entries that define it get
up to 3 scan attempts, retrying only when the probe says the output
looks incomplete. Persistent failures still fail via the validate
step. Each retry emits a warning annotation and a step-summary line
so flake frequency stays visible.
- Add tests/e2e/reach-facts-probe.sh: exits 0 when the facts file has
alerted components, non-zero (retry) when empty or missing.
- Upload /tmp/e2e-output.log, SARIF/GitLab outputs, and facts files as
artifacts when any e2e job fails, so flakes are diagnosable without
a re-run.
Also bump version to 2.6.2 (2.6.0 and 2.6.1 are being released ahead
of this PR).
Co-Authored-By: Claude Fable 5 <[email protected]>
…Dev/socket-python-cli into lelia/generic-purl-type-parse-bug
cursor[bot] reacted with thumbs up emoji
Sorry, something went wrong.
Uh oh!
There was an error while loading. Please reload this page.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
✅ Bugbot reviewed your changes and found no new issues!
Comment @cursor review or bugbot run to trigger another review on this PR
Reviewed by Cursor Bugbot for commit d0c5648. Configure here.
Sorry, something went wrong.
Uh oh!
There was an error while loading. Please reload this page.
lelia
changed the title
Raise on SBOM fetch failure and require socketdev 3.4.2
Raise on SBOM fetch failure and require socketdev 3.5.0
Aug 6, 2026
The e2e retry hardening ships with the dependency pinning PR instead,
so its changelog entry moves there.
Co-Authored-By: Claude Fable 5 <[email protected]>
Signed-off-by: lelia <[email protected]>
…pe-parse-bug
# Conflicts:
# .github/workflows/e2e-test.yml
# CHANGELOG.md
# pyproject.toml
# socketsecurity/__init__.py
# uv.lock
…Dev/socket-python-cli into lelia/generic-purl-type-parse-bug
# Conflicts:
# CHANGELOG.md
lelia
changed the title
Raise on SBOM fetch failure and require socketdev 3.5.0
Raise failure on SBOM fetch errors
Aug 6, 2026
lelia
changed the title
Raise failure on SBOM fetch errors
Raise on SBOM fetch failures (SDK >=3.5.0)
Aug 6, 2026
cursor[bot] reacted with thumbs up emoji
Sorry, something went wrong.
Uh oh!
There was an error while loading. Please reload this page.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
✅ Bugbot reviewed your changes and found no new issues!
Comment @cursor review or bugbot run to trigger another review on this PR
Reviewed by Cursor Bugbot for commit f9a4831. Configure here.
Sorry, something went wrong.
Uh oh!
There was an error while loading. Please reload this page.
lelia reacted with hooray emoji
lelia
changed the title
Raise on SBOM fetch failures (SDK >=3.5.0)
Raise failure on SBOM fetch errors
Aug 6, 2026
…pe-parse-bug
# Conflicts:
# CHANGELOG.md
# pyproject.toml
# socketsecurity/__init__.py
# uv.lock
Uh oh!
There was an error while loading. Please reload this page.
This branch was previously deployed
1 inactive
deployment
Uh oh!
There was an error while loading. Please reload this page.
Assignees
No one assigned
Milestone
No milestone
Development
Successfully merging this pull request may close these issues.
Uh oh!
There was an error while loading. Please reload this page.
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
|