feat(scan): forward socket.json build-tool config into reachability (1.1.120, Coana 15.4.1)#1362
Merged
Jeppe Fredsgaard Blaabjerg (jfblaa) merged 7 commits intoJun 16, 2026
Conversation
socket scan create --reach now maps socket.json's per-ecosystem manifest build-tool options (bin, include/exclude-configs, gradle/sbt opts) into a Coana-defined AutoManifestConfig and passes it to `coana run` via --auto-manifest-config (a temp JSON file path Coana reads), so reach-time dependency resolution invokes the build tool the way the project is configured rather than with defaults. Under --auto-manifest the config also carries top-level failOnBuildToolError=true (fail-closed: Coana treats a build-tool step failure as fatal instead of tolerating it); plain --reach leaves it unset and stays permissive. This is the socket-cli side of the manifest-flag-propagation gap. The Coana `--auto-manifest-config` option is not yet released, so this must not ship until Coana publishes it and the pinned @coana-tech/cli is bumped; until then it is exercised via SOCKET_CLI_COANA_LOCAL_PATH. - add src/utils/auto-manifest-config.mts: BuildToolOptions/AutoManifestConfig types + buildAutoManifestConfig (socket.json -> config) + tests - ReachabilityOptions.autoManifestConfig; write the config to a temp file and pass its path to coana run, cleaning it up after - build the config at the cmd-scan-create assembly point
…fig forwarding Bump @coana-tech/cli to 15.4.1 (which ships the --auto-manifest-config option the feat commit depends on), bump the package version to 1.1.120, and add the changelog entry.
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes using high effort and found 2 potential issues.
Bugbot Autofix is ON. A cloud agent has been kicked off to fix the reported issues.
Comment @cursor review or bugbot run to trigger another review on this PR
Reviewed by Cursor Bugbot for commit 478fb22. Configure here.
Only forward the socket.json build-tool config to `coana run` when the resolved Coana version supports `--auto-manifest-config` (>= 15.4.1). Passing the flag to an older Coana, pinned via --reach-version, would abort the run on an unknown flag; we now skip it and warn instead. A local Coana build (SOCKET_CLI_COANA_LOCAL_PATH) has no resolvable version and is treated as supported. Also drop internal tracker references from source comments.
…ld-tool-config-into-coanas-auto
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
Martin Torp (mtorp)
approved these changes
Jun 16, 2026
Coana is pinned to a specific version in the CLI, so gating --auto-manifest-config on a minimum version added no real safety; remove coanaSupportsAutoManifestConfig and forward the config unconditionally when non-empty. Move the temp config file cleanup into a finally block so it runs even if the Coana run throws.
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
Jeppe Fredsgaard Blaabjerg (jfblaa)
deleted the
jfblaa/rea-549-socket-cli-map-socketjson-build-tool-config-into-coanas-auto
branch
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Forwards
socket.jsonper-ecosystem build-tool config into reachability analysis, and bumps@coana-tech/clito15.4.1(which ships the--auto-manifest-configoption this depends on). Cuts release1.1.120.socket scan create --reachnow mapssocket.json's per-ecosystem manifest build-tool options (custom binary, include/exclude configs, Gradle/sbt opts) into a CoanaAutoManifestConfig, passed tocoana runvia--auto-manifest-config, so reach-time dependency resolution invokes the build tool the way the project is configured rather than with defaults.--auto-manifest --reachthe config carriesfailOnBuildToolError=true(fail-closed). Plain--reachleaves it unset and stays best-effort.Changelog (1.1.120)
socket scan create --reachnow applies your project's build-tool settings fromsocket.json(configured viasocket manifest setup) for Gradle/sbt reachability resolution, instead of always invoking the build tool with defaults.socket scan create --auto-manifest --reachnow fails with an error when a build tool fails during manifest generation, rather than tolerating it.15.4.5.Note
Medium Risk
Changes reachability and auto-manifest failure behavior (stricter with --auto-manifest) and depends on Coana 15.4.1; mis-mapped socket.json could affect Gradle/sbt resolution in scans.
Overview
Release 1.1.120 bumps
@coana-tech/clito 15.4.1 and wiressocket.jsonGradle/sbt manifest settings into reachability runs.socket scan create --reachnow mapsdefaults.manifestfromsocket.json(custom binary, include/exclude configs,gradleOpts/sbtOpts,ignoreUnresolved) into Coana’sAutoManifestConfig, written to a temp JSON file and passed as--auto-manifest-configoncoana run. With--auto-manifest --reach, the config setsfailOnBuildToolError=trueso build-tool failures abort the scan; plain--reachleaves that unset for best-effort behavior.New
buildAutoManifestConfig/isAutoManifestConfigEmptyutilities and unit tests cover the mapping; scan create only builds the config when--reachis enabled.Reviewed by Cursor Bugbot for commit 478fb22. Configure here.