feat(scan): add --dynamic-sbom-inference-ecosystems to choose which ecosystems use Socket facts

CHANGELOG.md

@@ -6,9 +6,12 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
 ## [Unreleased]
 
+### Added
+- Choose which ecosystems `--dynamic-sbom-inference` covers with `--dynamic-sbom-inference-ecosystems` (`maven` for Gradle, sbt and Maven; `nuget` for .NET) on `socket scan create`, `socket scan reach` and `socket fix`. Ecosystems left out keep their manifest files as they are.
+
 ### Changed
 - With `--dynamic-sbom-inference`, reachability analysis and `socket fix` now take the dependencies of every Gradle, sbt, Maven and .NET build they find from Socket facts only, so results no longer depend on which other builds produced facts.
-- `--dynamic-sbom-inference` and its setup now stop with clear next steps when a .NET build cannot be read because no .NET SDK is installed, instead of skipping it. With it, reachability analysis and `socket fix` warn that builds skipped in `socket.json` are left out, and reachability analysis stops with next steps when no build produced Socket facts.
+- `socket manifest auto`, `--auto-manifest` and `--dynamic-sbom-inference` (with its setup) now fail a .NET build that has no usable .NET SDK, as they do a Maven build without Maven, instead of skipping it. With `--dynamic-sbom-inference`, reachability analysis and `socket fix` warn that builds skipped in `socket.json` are left out, and reachability analysis stops with next steps when no build produced Socket facts.
 
 ## [1.13.1](https://github.com/SocketDev/socket-cli/releases/tag/v1.13.1) - 2026-11-03
 

src/commands/ci/handle-ci.mts

@@ -65,7 +65,7 @@ export async function handleCi(autoManifest: boolean): Promise<void> {
     pendingHead: true,
     pullRequest: detectCiPullRequestNumber(),
     reach: {
-      dynamicSbomInference: false,
+      dynamicSbomInference: undefined,
       excludePaths: [],
       reachAdvisories: [],
       reachAnalysisMemoryLimit: '',

src/commands/fix/cmd-fix.integration.test.mts

@@ -170,6 +170,7 @@ describe('socket fix', async () => {
             --debug             Enable debug logging in the Coana-based Socket Fix CLI invocation.
             --disable-external-tool-checks  Disable external tool checks during fix analysis.
             --dynamic-sbom-inference  For Gradle, sbt, Maven and .NET: generate a Socket facts SBOM (produced directly by each package manager) per independent build root, instead of one synthetic root. Fixes are then attributed to the projects/modules that actually resolve each vulnerable dependency. The generated files are removed afterwards.
+            --dynamic-sbom-inference-ecosystems  With --dynamic-sbom-inference: generate Socket facts only for these ecosystems, as either a comma separated value or as multiple flags; the others keep their manifest files as they are. Supported: maven (Gradle, Maven, and sbt) and nuget (.NET). Defaults to all of them.
             --ecosystems        Limit fix analysis to specific ecosystems. Accepts space- or comma-separated values and is case-insensitive. Defaults to all ecosystems.
             --exclude-paths     Skip matching paths from the scan entirely: manifests under these paths are not uploaded, and fixes are not applied to workspaces under them. Patterns are anchored micromatch globs matched relative to the target directory (CWD); \`data/postgres/pgdata\` matches that exact path, \`**/pgdata\` matches at any depth. Use this to skip directories the current user cannot read so they do not abort manifest collection. Negation patterns (\`!path\`) are not supported. Accepts a comma-separated value or multiple flags.
             --fix-version       Override the version of @coana-tech/cli used for fix analysis. Default: <coana-version>.

src/commands/fix/cmd-fix.mts

@@ -19,7 +19,10 @@ import constants, {
 import { commonFlags, outputFlags } from '../../flags.mts'
 import { checkCommandInput } from '../../utils/check-input.mts'
 import { cmdFlagValueToArray } from '../../utils/cmd.mts'
-import { getEcosystemChoicesForMeow } from '../../utils/ecosystem.mts'
+import {
+  getEcosystemChoicesForMeow,
+  parseEcosystemChoices,
+} from '../../utils/ecosystem.mts'
 import { getOutputKind } from '../../utils/get-output-kind.mts'
 import { meowOrExit } from '../../utils/meow-with-subcommands.mts'
 import {
@@ -33,10 +36,13 @@ import {
 import { RangeStyles } from '../../utils/semver.mts'
 import { getDefaultOrgSlug } from '../ci/fetch-default-org-slug.mts'
 import { assertValidExcludePaths } from '../scan/exclude-paths.mts'
-import { DYNAMIC_SBOM_INFERENCE_DESCRIPTION } from '../scan/reachability-flags.mts'
+import {
+  DYNAMIC_SBOM_INFERENCE_DESCRIPTION,
+  dynamicSbomInferenceEcosystemsFlags,
+  parseDynamicSbomInferenceFlags,
+} from '../scan/reachability-flags.mts'
 
 import type { MeowFlag, MeowFlags } from '../../flags.mts'
-import type { PURL_Type } from '../../utils/ecosystem.mts'
 import type {
   CliCommandConfig,
   CliCommandContext,
@@ -190,6 +196,7 @@ Available styles:
     default: false,
     description: `${DYNAMIC_SBOM_INFERENCE_DESCRIPTION} Fixes are then attributed to the projects/modules that actually resolve each vulnerable dependency. The generated files are removed afterwards.`,
   },
+  ...dynamicSbomInferenceEcosystemsFlags,
   ecosystems: {
     type: 'string',
     default: [],
@@ -339,7 +346,6 @@ async function run(
     autopilot,
     debug,
     disableExternalToolChecks,
-    dynamicSbomInference,
     ecosystems,
     exclude,
     excludePaths,
@@ -367,7 +373,6 @@ async function run(
     autopilot: boolean
     debug: boolean
     disableExternalToolChecks: boolean
-    dynamicSbomInference: boolean
     ecosystems: string[]
     exclude: string[]
     excludePaths: string[]
@@ -398,26 +403,13 @@ async function run(
 
   const outputKind = getOutputKind(json, markdown)
 
-  // Process comma-separated values for ecosystems flag.
-  // ALL_ECOSYSTEMS is lowercase, so normalize input for a case-insensitive
-  // match (mirrors --package-managers behavior).
-  const ecosystemsRaw = cmdFlagValueToArray(ecosystems).map(s =>
-    s.toLowerCase(),
-  )
+  const dynamicSbomInference = parseDynamicSbomInferenceFlags(cli.flags)
 
   // Validate ecosystem values early, before dry-run check.
-  const validatedEcosystems: PURL_Type[] = []
-  const validEcosystemChoices = getEcosystemChoicesForMeow()
-  for (const ecosystem of ecosystemsRaw) {
-    if (!validEcosystemChoices.includes(ecosystem)) {
-      logger.fail(
-        `Invalid ecosystem: "${ecosystem}". Valid values are: ${joinAnd(validEcosystemChoices)}`,
-      )
-      process.exitCode = 1
-      return
-    }
-    validatedEcosystems.push(ecosystem as PURL_Type)
-  }
+  const validatedEcosystems = parseEcosystemChoices(
+    cmdFlagValueToArray(ecosystems),
+    getEcosystemChoicesForMeow(),
+  )
 
   // Process and validate package manager values early, before dry-run check.
   // Coana normalizes input to uppercase and rejects unknown values, so do the

src/commands/fix/coana-fix-dynamic-sbom-inference.test.mts

@@ -102,7 +102,7 @@ describe('socket fix --dynamic-sbom-inference', () => {
     debug: false,
     disableExternalToolChecks: false,
     disableMajorUpdates: false,
-    dynamicSbomInference: true,
+    dynamicSbomInference: ['maven'],
     ecosystems: [],
     exclude: [],
     excludePaths: [],
@@ -147,6 +147,9 @@ describe('socket fix --dynamic-sbom-inference', () => {
     const result = await coanaFix(baseConfig)
 
     expect(result.ok).toBe(true)
+    expect(mockGenerateSocketFactsForFix).toHaveBeenCalledWith(
+      expect.objectContaining({ purlTypes: ['maven'] }),
+    )
     expect(uploadManifestFiles).toHaveBeenCalledWith(
       'test-org',
       ['/test/cwd/app/build.gradle', FACTS],
@@ -196,7 +199,7 @@ describe('socket fix --dynamic-sbom-inference', () => {
 
     const result = await coanaFix({
       ...baseConfig,
-      dynamicSbomInference: false,
+      dynamicSbomInference: undefined,
     })
 
     expect(result.ok).toBe(true)
@@ -211,15 +214,15 @@ describe('socket fix --dynamic-sbom-inference', () => {
       FACTS,
     ])
 
-    await coanaFix({ ...baseConfig, dynamicSbomInference: false })
+    await coanaFix({ ...baseConfig, dynamicSbomInference: undefined })
 
     expect(uploadManifestFiles).toHaveBeenCalledWith('test-org', [FACTS], {
       pathsRelativeTo: '/test/cwd',
     })
   })
 
   it('does not pass the facts restriction without the flag', async () => {
-    await coanaFix({ ...baseConfig, dynamicSbomInference: false })
+    await coanaFix({ ...baseConfig, dynamicSbomInference: undefined })
 
     expect(mockGenerateSocketFactsForFix).not.toHaveBeenCalled()
     expect(coanaCalls('compute-fixes-and-upgrade-purls')[0]).not.toContain(

src/commands/fix/coana-fix.mts

@@ -60,6 +60,7 @@ import { fetchSupportedScanFileNames } from '../scan/fetch-supported-scan-file-n
 import type { GeneratedSocketFacts } from './generated-socket-facts.mts'
 import type { FixConfig } from './types.mts'
 import type { CResult } from '../../types.mts'
+import type { FactsOnlyTypes } from '../../utils/coana.mts'
 import type { PURL_Type } from '../../utils/ecosystem.mts'
 import type { Spinner } from '@socketsecurity/registry/lib/spinner'
 
@@ -283,15 +284,17 @@ function formatNotAppliedFixes(notApplied: NotAppliedFix[]): string {
 
 type GeneratedSocketFactsSlot = {
   generated?: GeneratedSocketFacts | undefined
+  purlTypes: FactsOnlyTypes
   tmpDir: string
 }
 
 export async function coanaFix(fixConfig: FixConfig): Promise<CoanaFixResult> {
-  if (!fixConfig.dynamicSbomInference) {
+  const purlTypes = fixConfig.dynamicSbomInference
+  if (!purlTypes) {
     return await coanaFixWithFacts(fixConfig, undefined)
   }
   return await withTmpDir('socket-fix-facts-', async tmpDir => {
-    const slot: GeneratedSocketFactsSlot = { tmpDir }
+    const slot: GeneratedSocketFactsSlot = { purlTypes, tmpDir }
     try {
       return await coanaFixWithFacts(fixConfig, slot)
     } finally {
@@ -391,13 +394,12 @@ async function coanaFixWithFacts(
   if (factsSlot) {
     if (!silence) {
       spinner?.stop()
-      logger.info(
-        'Generating Socket facts for .NET, Gradle, sbt and Maven builds ...',
-      )
+      logger.info('Generating Socket facts for each build ...')
     }
     factsSlot.generated = await generateSocketFactsForFix({
       cwd,
       excludePaths,
+      purlTypes: factsSlot.purlTypes,
       findFactsPaths: async () =>
         (await findScanFilepaths()).filter(isSocketFactsFile),
       tmpDir: factsSlot.tmpDir,

src/commands/fix/generated-socket-facts.mts

@@ -4,12 +4,14 @@ import path from 'node:path'
 import { useOnlySocketFactsArtifactsFlags } from '../../utils/coana.mts'
 import { runDynamicSbomInference } from '../scan/run-dynamic-sbom-inference.mts'
 
+import type { PURL_Type } from '../../utils/ecosystem.mts'
+
 export type GeneratedSocketFacts = {
   // Coana's flags selecting what the facts files resolve.
   artifactsFlags: string[]
   paths: string[]
   // The facts files' per-project classpaths, written outside the repository.
-  sidecarFile: string | undefined
+  sidecarFile: string
   remove: () => Promise<void>
   restore: () => Promise<void>
 }
@@ -39,11 +41,13 @@ export async function generateSocketFactsForFix({
   cwd,
   excludePaths,
   findFactsPaths,
+  purlTypes,
   tmpDir,
 }: {
   cwd: string
   excludePaths: string[]
   findFactsPaths: () => Promise<string[]>
+  purlTypes: readonly PURL_Type[]
   tmpDir: string
 }): Promise<GeneratedSocketFacts> {
   const existingPaths = await findFactsPaths()
@@ -57,21 +61,21 @@ export async function generateSocketFactsForFix({
   }
   let artifactsFlags: string[]
   let paths: string[]
-  let sidecarFile: string | undefined
+  const sidecarFile = path.join(tmpDir, 'sidecar.json')
   try {
     const { factsOnlyTypes, factsPaths, resolvedPathsSidecar } =
       await runDynamicSbomInference({
         consumer: 'fix',
         cwd,
         excludePaths,
+        purlTypes,
         sbtTmpDir: undefined,
       })
     artifactsFlags = useOnlySocketFactsArtifactsFlags(factsOnlyTypes)
     paths = factsPaths.map(p => path.resolve(cwd, p))
-    if (resolvedPathsSidecar) {
-      sidecarFile = path.join(tmpDir, 'sidecar.json')
-      await writeFile(sidecarFile, JSON.stringify(resolvedPathsSidecar))
-    }
+    // Written even when empty, as for reach; applying fixes looks each facts
+    // file up in it, so an empty one is the same as none.
+    await writeFile(sidecarFile, JSON.stringify(resolvedPathsSidecar ?? {}))
   } catch (e) {
     // A failed build root aborts inference after others wrote their facts.
     await reset(await findFactsPaths())

src/commands/fix/generated-socket-facts.test.mts

@@ -37,6 +37,7 @@ describe('generateSocketFactsForFix', () => {
       cwd,
       excludePaths: [],
       findFactsPaths: async () => [existing, fresh].filter(p => existsSync(p)),
+      purlTypes: ['maven'],
       tmpDir,
     })
   }
@@ -75,18 +76,30 @@ describe('generateSocketFactsForFix', () => {
     const { artifactsFlags, sidecarFile } = await generate()
 
     expect(mockRunDynamicSbomInference).toHaveBeenCalledWith(
-      expect.objectContaining({ consumer: 'fix' }),
+      expect.objectContaining({ consumer: 'fix', purlTypes: ['maven'] }),
     )
     expect(artifactsFlags).toEqual([
       '--use-only-socket-facts-artifacts',
       'maven,nuget',
     ])
-    expect(path.dirname(sidecarFile!)).toBe(tmpDir)
-    expect(JSON.parse(await fs.readFile(sidecarFile!, 'utf8'))).toEqual({
+    expect(path.dirname(sidecarFile)).toBe(tmpDir)
+    expect(JSON.parse(await fs.readFile(sidecarFile, 'utf8'))).toEqual({
       [fresh]: { components: [], projects: [] },
     })
   })
 
+  it('writes an empty sidecar when no build root resolved any paths', async () => {
+    mockRunDynamicSbomInference.mockResolvedValue({
+      factsOnlyTypes: ['maven'],
+      factsPaths: [],
+    })
+
+    const { artifactsFlags, sidecarFile } = await generate()
+
+    expect(artifactsFlags).toEqual(['--maven-use-only-socket-facts'])
+    expect(JSON.parse(await fs.readFile(sidecarFile, 'utf8'))).toEqual({})
+  })
+
   it('restores an existing facts file that generation does not rewrite', async () => {
     mockRunDynamicSbomInference.mockImplementation(async () => {
       await fs.writeFile(fresh, 'generated')

src/commands/fix/types.mts

@@ -1,3 +1,4 @@
+import type { FactsOnlyTypes } from '../../utils/coana.mts'
 import type { PURL_Type } from '../../utils/ecosystem.mts'
 import type { RangeStyle } from '../../utils/semver.mts'
 import type { Spinner } from '@socketsecurity/registry/lib/spinner'
@@ -12,7 +13,8 @@ export type FixConfig = {
   debug: boolean
   disableExternalToolChecks: boolean
   disableMajorUpdates: boolean
-  dynamicSbomInference: boolean
+  // The ecosystems to generate Socket facts for; undefined when off.
+  dynamicSbomInference: FactsOnlyTypes | undefined
   ecosystems: PURL_Type[]
   exclude: string[]
   excludePaths: string[]

src/commands/manifest/discover-manifest-roots.mts

@@ -5,7 +5,13 @@ import micromatch from 'micromatch'
 
 import { logger } from '@socketsecurity/registry/lib/logger'
 
-import { BUILD_FILES, isDotnetSolution } from './scripts/build-tool.mts'
+import {
+  BUILD_FILES,
+  BUILD_TOOLS,
+  FACTS_PURL_TYPES,
+  buildToolsFor,
+  isDotnetSolution,
+} from './scripts/build-tool.mts'
 import { listDotnetEntryProjects } from './scripts/run.mts'
 import { realpathOrResolved } from '../../utils/fs.mts'
 import { globWithGitIgnore } from '../../utils/glob.mts'
@@ -14,11 +20,10 @@ import { excludePathToScanIgnores } from '../scan/exclude-paths.mts'
 import type { BuildTool } from './scripts/build-tool.mts'
 import type { SocketFactsSbomProject } from './scripts/facts.mts'
 import type { ManifestScriptOptions } from './scripts/run.mts'
+import type { PURL_Type } from '../../utils/ecosystem.mts'
 import type { SocketJson } from '../../utils/socket-json.mts'
 import type { SocketYml } from '@socketsecurity/config'
 
-const BUILD_TOOLS: BuildTool[] = ['dotnet', 'gradle', 'maven', 'sbt']
-
 const BUILD_FILE_MATCHERS = new Map(
   BUILD_TOOLS.map(tool => {
     const files = BUILD_FILES[tool]
@@ -222,17 +227,19 @@ export function sortByDepthThenPath<T extends BuildRoot>(
 export async function findBuildToolCandidates({
   cwd,
   excludePaths,
+  purlTypes = FACTS_PURL_TYPES,
   sockJson,
   socketConfig,
 }: {
   cwd: string
   excludePaths?: string[] | undefined
+  purlTypes?: readonly PURL_Type[] | undefined
   // The socket.yml a scan applies to its upload, so a build file a scan would
   // not upload is not built either.
   socketConfig: SocketYml | undefined
   sockJson: SocketJson
 }): Promise<Map<BuildTool, BuildRoot[]>> {
-  const enabledTools = BUILD_TOOLS.filter(
+  const enabledTools = buildToolsFor(purlTypes).filter(
     tool => !sockJson.defaults?.manifest?.[tool]?.disabled,
   )
   const result = new Map<BuildTool, BuildRoot[]>()