GeezerVison

All reactions

Pin every runtime dependency in pyproject.toml to an exact version,
replace the bs4 shim with a direct beautifulsoup4 dependency, pin the
socketdev SDK to 3.4.2, and install Docker image dependencies from the
committed uv.lock with pip hash verification so image builds no longer
resolve loose versions from PyPI at build time. Also pins the hatchling
build backend and the uv binary used in the Dockerfile.

Refs CE-359.

Co-Authored-By: Claude Fable 5 <[email protected]>
Signed-off-by: lelia <[email protected]>

Copy link

Copy Markdown

lelia temporarily deployed to socket-firewall August 5, 2026 23:36 — with GitHub Actions Inactive

Pass explicit production index flags on the hash-locked dependency
install so the PIP_INDEX_URL/PIP_EXTRA_INDEX_URL build args (pointed at
TestPyPI by the preview build scripts) don't leak in via pip's env
vars, and move pip check ahead of the SDK_VERSION override so a preview
SDK that deviates from the exact socketdev pin doesn't abort the build.

Addresses PR#289 review findings.

Co-Authored-By: Claude Fable 5 <[email protected]>
Signed-off-by: lelia <[email protected]>

lelia temporarily deployed to socket-firewall August 6, 2026 00:34 — with GitHub Actions Inactive

Copy link

Copy Markdown

Contributor Author

cursor Bot left a comment •

edited

Loading

Uh oh!

There was an error while loading. Please reload this page.

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

Autofix Details

Bugbot Autofix prepared a fix for the issue found in the latest run.

• ✅ Fixed: pip check failure ignored
  • Changed pip check; to pip check && so a failed dependency check fails the Docker RUN instead of being masked by the following SDK_VERSION if-block.

Or push these changes by commenting:

@cursor push 1031f03076

Preview (1031f03076)

diff --git a/Dockerfile b/Dockerfile
--- a/Dockerfile
+++ b/Dockerfile
@@ -143,7 +143,7 @@
             echo "Failed to install socketsecurity==$CLI_VERSION after 10 attempts"; \
             exit 1; \
         fi; \
-        pip check; \
+        pip check && \
         if [ ! -z "$SDK_VERSION" ]; then \
             pip install --index-url ${PIP_INDEX_URL} --extra-index-url ${PIP_EXTRA_INDEX_URL} socketdev==${SDK_VERSION}; \
         fi; \

_{You can send follow-ups to the cloud agent here.}

Copy link

Copy Markdown

Contributor Author

Copy link

Copy Markdown

Docker's shell-form RUN only propagates the last command's exit status,
so once pip check moved ahead of the SDK_VERSION block its failure was
silently discarded whenever SDK_VERSION was empty or the override
install succeeded. Gate it explicitly with || exit 1.

Addresses PR#289 review finding.

Co-Authored-By: Claude Fable 5 <[email protected]>
Signed-off-by: lelia <[email protected]>

lelia temporarily deployed to socket-firewall August 6, 2026 02:19 — with GitHub Actions Inactive

Copy link

Copy Markdown

Contributor Author

cursor Bot left a comment

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit fed545a. Configure here.}

Co-Authored-By: Claude Fable 5 <[email protected]>
Signed-off-by: lelia <[email protected]>

lelia temporarily deployed to socket-firewall August 6, 2026 02:34 — with GitHub Actions Inactive

Switching to fully pinned dependencies warrants a minor bump rather
than a patch.

Co-Authored-By: Claude Fable 5 <[email protected]>
Signed-off-by: lelia <[email protected]>

lelia temporarily deployed to socket-firewall August 6, 2026 02:54 — with GitHub Actions Inactive

David Larsen (dc-larsen) left a comment

Approving — validated locally end to end.

• uv build produces 2.6.0 with every pin present in the wheel metadata (requests==2.34.2, socketdev==3.4.2, beautifulsoup4==4.14.3, etc.)
• uv sync --locked clean; test suite 351 passed / 2 skipped, matching your numbers
• Replayed the Dockerfile sequence in a clean venv: the exact uv export line yields 22 requirements, all hash-pinned, markers preserved, project correctly excluded; pip install --require-hashes --no-deps then the wheel --no-deps, and pip check reports no broken requirements
• bs4 swap is correct — with the shim uninstalled, from bs4 import BeautifulSoup, Tag and from bs4.element import NavigableString both resolve from beautifulsoup4 4.14.3, and socketcli --version reports 2.6.0
• hatchling==1.31.0 needs Python >=3.10 and this package requires >=3.11, so no conflict here (worth noting it does conflict in the SDK, which still declares >=3.9)

Ingest the SDK release that bounds its own runtime dependency ranges,
so the pinned closure is hygienic end to end.

Co-Authored-By: Claude Fable 5 <[email protected]>
Signed-off-by: lelia <[email protected]>

lelia temporarily deployed to socket-firewall August 6, 2026 03:50 — with GitHub Actions Inactive

…python-cli

lelia temporarily deployed to socket-firewall August 6, 2026 03:53 — with GitHub Actions Inactive

…ailure

The e2e-reachability job intermittently fails with 'no components with
alerts in .socket.facts.json': the tier-1 reachability backend can
return empty results while the CLI reports success (ENG-5093), and the
same flake has hit unrelated PRs.

- Add a retry-probe hook to the e2e matrix: entries that define it get
  up to 3 scan attempts, retrying only when the probe says the output
  looks incomplete. Persistent failures still fail via the validate
  step. Each retry emits a warning annotation and a step-summary line
  so flake frequency stays visible.
- Add tests/e2e/reach-facts-probe.sh: exits 0 when the facts file has
  alerted components, non-zero (retry) when empty or missing.
- Upload /tmp/e2e-output.log, SARIF/GitLab outputs, and facts files as
  artifacts when any e2e job fails, so flakes are diagnosable without
  a re-run.

Also bump version to 2.6.2 (2.6.0 and 2.6.1 are being released ahead
of this PR).

Co-Authored-By: Claude Fable 5 <[email protected]>

lelia temporarily deployed to socket-firewall August 6, 2026 03:55 — with GitHub Actions Inactive

lelia temporarily deployed to socket-firewall August 6, 2026 03:58 — with GitHub Actions Inactive

Co-Authored-By: Claude Fable 5 <[email protected]>
Signed-off-by: lelia <[email protected]>

lelia temporarily deployed to socket-firewall August 6, 2026 04:16 — with GitHub Actions Inactive