Don't render .socket.facts.json placeholder as blocking package - #321
Merged
lelia merged 1 commit intoSep 2, 2026
Merged
Conversation
lelia
changed the title
.socket.facts.json placeholder file as blocking package
lelia
changed the title
.socket.facts.json placeholder file as blocking package.socket.facts.json placeholder as blocking package
lelia
added
publish-preview
|
🐳 Docker preview published: This mutable tag is only created when a Docker preview is explicitly requested. |
|
🚀 CLI preview published: pip install --index-url https://test.pypi.org/simple/ --extra-index-url https://pypi.org/simple socketsecurity==2.6.9.dev3312870820701TestPyPI's package index can take several minutes to expose a newly uploaded version. |
Eric Hibbs (flowstate)
approved these changes
Aug 28, 2026
Eric Hibbs (flowstate)
left a comment
Eric Hibbs (flowstate)
left a comment
Contributor
There was a problem hiding this comment.
See my note about comment nits, but the important stuff lgtm
lelia
force-pushed
the
lelia/ce-422-python-cli-treats-invalid-socketfactsjson-error-as-blocking
branch
from
September 2, 2026 20:23
01b89e4 to
7e3c634
Compare
Scans with no supported manifest files uploaded a zero-byte `.socket.facts.json` placeholder. The API cannot parse that and responds by adding a synthetic `generic/invalid-socket-facts@1.0.0` artifact, which the CLI then reported as a new blocking package with no manifest file and no introducing dependency, failing the run and posting a pull request comment that could not be acted on. - Write an empty but well-formed facts document as the placeholder. - Give each placeholder its own temp directory, so concurrent runs cannot remove each other's file mid-upload. - Filter the `generic/invalid-socket-facts` marker out of full scan and diff artifacts, logging a warning instead. It is a diagnostic, not a dependency.
lelia
force-pushed
the
lelia/ce-422-python-cli-treats-invalid-socketfactsjson-error-as-blocking
branch
from
September 2, 2026 20:34
7e3c634 to
01f2d81
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
When a scan finds no supported manifest files, the CLI uploads a placeholder named
.socket.facts.jsonso the upload passes the API's supported-filename validator. That placeholder was zero bytes, which the API cannot parse as a facts document — it responds by adding a syntheticgeneric/invalid-socket-facts@1.0.0artifact carrying a blocking alert.The CLI read that back as a real dependency, so the run reported a new blocking package with no manifest file and no introducing dependency, exited non-zero, and on pull requests posted a security comment that a developer had no way to act on.
Changes
$TMPDIR/.socket.facts.jsonmeant two runs sharing a temp directory could remove each other's file mid-upload.generic/invalid-socket-factsis dropped from full scan artifacts and from every diff bucket (added/removed/unchanged/replaced/updated), with a warning logged in its place. Filtering happens before the artifact-count log lines so the counts describe what the CLI actually reports on. With no new alerts, the existing gate insocketcli.pysuppresses the security comment on its own.Testing
tests/core/test_invalid_facts_marker.py(13 tests). The eight behavioral ones were confirmed to fail against the pre-fix code. Full suite: 492 passed.Note
That the backend accepts the new placeholder payload is not verified against a live API — there is no no-manifest scenario in the e2e workflow. If the schema wants more, the marker filtering still prevents the block and the comment, but the placeholder would keep tripping the parser. Worth a preview build against a repository with no manifests to confirm the resulting scan carries no
invalid-socket-factsartifact.Fixes CE-422
Note
Medium Risk
Changes core scan/diff artifact handling and empty-scan upload behavior, which directly affects blocking exits and PR comments, though the logic is narrow and well-tested.
Overview
Fixes CE-422, where scans with no manifest files could fail CI and post unusable PR security comments.
Placeholder uploads no longer write a zero-byte
.socket.facts.json(which the API could not parse). They now upload a minimal valid document ({"components": []}), and each run gets its own temp directory (with exit-time cleanup) instead of sharing a fixed$TMPDIR/.socket.facts.jsonpath that concurrent jobs could clobber.API diagnostic artifact
generic/invalid-socket-factsis treated as a parse-failure signal, not a dependency: it is stripped from full-scan SBOM artifacts and from every diff bucket before package/alert assembly and count logging, with a warning when present. Runs no longer treat it as a new blocking package or PR comment fodder.Release 2.6.9 with changelog and focused tests in
test_invalid_facts_marker.py.Reviewed by Cursor Bugbot for commit 01b89e4. Configure here.