feat(manifest): default to Socket facts, delegate generation to Coana CLI by jfblaa · Pull Request #1352 · SocketDev/socket-cli

Jeppe Fredsgaard Blaabjerg (jfblaa) · 2026-06-02T09:46:20Z

Summary

Make socket manifest {gradle,kotlin,scala,auto} emit .socket.facts.json by default and add --pom for the legacy pom.xml generation.

Facts generation now delegates to the Coana CLI's manifest gradle|sbt command via spawnCoanaDlx (which honors SOCKET_CLI_COANA_LOCAL_PATH). socket-cli no longer runs gradle/sbt itself for the facts path; the build-tool resolution scripts live in Coana.
New shared helper coana-manifest-facts.mts; convert-gradle-to-facts / convert-sbt-to-facts are now thin wrappers.
Default flip: facts is the default; --pom opts into pom.xml generation. --facts is still accepted (it's the default); socket.json facts: false still selects pom; passing --facts --pom together warns and generates facts. socket manifest auto flipped to match.
Removed the now-dead bundled socket-facts.init.gradle, the sbt plugin, their rollup copy steps, and the gradle-facts test fixtures (ported to Coana). The pom-path init.gradle is unchanged.

The resolved artifact-paths sidecar (file paths used for reachability) stays internal to Coana — socket manifest only requests the uploadable facts file.

Testing

check:tsc, check:lint, Biome clean; full unit suite passing (help snapshots + auto-manifest tests updated).
Live: socket manifest gradle (no flags) against a Gradle (Fabric Loom) test project delegates to a local Coana build and produces the expected .socket.facts.json.

Linear: REA-507 (related: REA-509)

Note

High Risk
Default output flipped from pom.xml to facts and facts now depend on Coana manifest subcommands that may not ship in the pinned CLI version yet, so this is a breaking UX change with an external runtime dependency.

Overview
socket manifest gradle, kotlin, and scala now emit .socket.facts.json by default; --pom opts into the previous pom.xml path. --configs is replaced by --include-configs and --exclude-configs. socket manifest auto, socket.json defaults, and the setup wizard follow the same default and flag names.

Facts generation no longer runs Gradle/sbt or ships in-repo resolution scripts. A new coana-manifest-facts.mts helper forwards to coana manifest gradle|sbt via spawnCoanaDlx; the Gradle/sbt facts converters are thin wrappers. Bundled socket-facts.init.gradle and the sbt facts plugin, their rollup copy steps, and local gradle-facts fixtures are removed. The pom init.gradle path is unchanged. Release 1.1.113 bumps @coana-tech/cli to 15.3.19.

^{Reviewed by Cursor Bugbot for commit acdba63. Configure here.}

… CLI Make `socket manifest {gradle,kotlin,scala,auto}` emit `.socket.facts.json` by default; add `--pom` for the legacy pom.xml generation. `--facts` is still accepted (it is now the default) and socket.json `facts: false` still selects pom generation. Facts generation now delegates to the Coana CLI's `manifest gradle|sbt` command (the Gradle init script and sbt plugin live in Coana now), forwarding --bin/--configs/--ignore-unresolved/--gradle-opts/--sbt-opts via spawnCoanaDlx (which honors SOCKET_CLI_COANA_LOCAL_PATH for local builds). Remove the now-dead bundled socket-facts.init.gradle, the sbt plugin, their rollup copy steps, and the ported gradle-facts test fixtures. The pom-path init.gradle is unchanged. REA-507

…configs Match the Coana CLI's split of `--configs` into `--include-configs` and `--exclude-configs` for `socket manifest {gradle,kotlin,scala,auto}`; both forward to Coana as `--include-configs` / `--exclude-configs`. `--include-configs` keeps the old include-only semantics; `--exclude-configs` skips matching configurations (applied after the include filter). The old `--configs` flag and its socket.json `configs` key are removed (beta; clean break, no deprecated alias). REA-507

Match the gradle flag description and help prose: drop the sbt-only "bare names act as exact-name filters" / "for variants" asides so both ecosystems document the include/exclude config flags identically as globs.

`socket manifest setup` now reflects Socket facts as the default for the gradle and sbt generators and lets you configure the facts-only options it previously couldn't: --include-configs, --exclude-configs, and --ignore-unresolved. These are prompted only when facts generation is selected (not --pom), and the sbt pom output questions (stdout/outfile) now only appear when pom is chosen. Refreshes the stale "generate pom.xml (default)" wording left over from the facts-by-default switch.

Finalizes the manifest facts-by-default / Coana-delegation work: bumps the socket-cli version to 1.1.113 and pins @coana-tech/cli to the published 15.3.19 (which ships the `manifest gradle|sbt` commands this PR delegates to), plus the 1.1.113 CHANGELOG entry. REA-507

socket-security · 2026-06-03T10:54:58Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/@coana-tech/cli@15.3.19

View full report

socket-security-staging · 2026-06-03T10:56:55Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/@coana-tech/cli@15.3.19

View full report

Martin Torp (mtorp)

A few minor, non-blocking nits from the review (docs/comments + one UX design question). Nothing here blocks merge — the two larger items (the default-output flip and the Coana 15.3.19 runtime dependency) are intentional/documented and I'll raise those separately.

Martin Torp (mtorp) · 2026-06-03T12:01:58Z

-        'With --facts: comma-separated glob patterns matched against Gradle configuration names (case-sensitive, `*` and `?` wildcards). e.g. `*CompileClasspath,*RuntimeClasspath` to skip tooling configs. Default: every resolvable configuration except AGP instrumented-test classpaths',
+        'When generating facts: comma-separated glob patterns; Gradle configurations matching any pattern are skipped (applied after --include-configs)',
    },
    ignoreUnresolved: {


Nit (consistency): now that facts is the default, this --ignore-unresolved description (line 55) still reads "With --facts: ..." while the adjacent --include-configs / --exclude-configs were reworded to "When generating facts: ...". Worth aligning the wording. The same --ignore-unresolved string also appears in cmd-manifest-kotlin.mts and cmd-manifest-scala.mts (and their help snapshots), so they'd need updating together.

Martin Torp (mtorp) · 2026-06-03T12:01:58Z

+// facts file.
+//
+// `spawnCoanaDlx` resolves the Coana CLI via dlx (or a local build when
+// `SOCKET_CLI_COANA_LOCAL_PATH` is set). `bin` (the gradle/sbt executable) is


Nit (comment accuracy / dead branch): the helper forwards --bin only via if (bin), and this comment says "when empty, Coana applies the … default (./gradlew, or sbt on PATH)". But every caller — cmd-manifest-{gradle,kotlin,scala}.mts and generate_auto_manifest.mts — already defaults bin to <cwd>/gradlew or sbt before calling, so bin is never empty here and the "when empty" path is effectively dead. Not a bug (the forwarded defaults match Coana's), but either the comment overstates reality or the empty-guard could be dropped.

Martin Torp (mtorp) · 2026-06-03T12:01:58Z

+    logger.fail(result.message || 'Coana failed to generate Socket facts')
+    return
+  }
+  logger.success('Generated Socket facts')


Nit (messaging): this prints logger.success('Generated Socket facts') + the next-step line unconditionally on any result.ok. The old converters detected the "no resolvable dependencies" skip and warned instead. Now that detection lives in Coana, a Coana run that exits 0 but writes no facts file would still print a success/next-step message here. Fine if Coana always signals the no-deps case via a non-zero exit or its own output; flagging in case the unconditional success line can mislead.

Martin Torp (mtorp) · 2026-06-03T12:01:58Z

  ) {
    logger.warn(
-      'The `--configs` and `--ignore-unresolved` options only apply with `--facts`; ignoring them.',
+      'The `--include-configs`, `--exclude-configs`, and `--ignore-unresolved` options only apply when generating Socket facts (not with `--pom`); ignoring them.',


Two notes on the --out/--stdout block just below (lines 287–299, unchanged by this PR):

Stale comment — lines 287–291 still reference "the plugin" and "socket.outputDirectory/outputFile JVM props", which moved into Coana; socket-cli no longer owns an sbt plugin, so the rationale reads out of date.

UX (design call, non-blocking) — with facts now the default, socket manifest scala --out foo.xml (no --pom) silently generates facts and warns that --out/--stdout don't apply. A user passing --out/--stdout almost certainly wanted pom output. Consider treating those flags as implying --pom, or keep requiring explicit --pom if that's the intended contract.

Martin Torp (mtorp)

Approving the code. Verified locally: check:tsc, ESLint, and the manifest unit suite (22/22) all pass; build is clean. Traced the facts/--pom default-flip logic and the generateAutoManifest opt-out across all branches — correct. All converter call sites updated, no dangling refs to the removed init.gradle/sbt-plugin/fixtures, version pin consistent.

Left a few minor doc/comment nits inline; none are blocking.

Jeppe Fredsgaard Blaabjerg (jfblaa) added 5 commits June 2, 2026 11:45

docs(manifest): align sbt --include-configs wording with gradle

20a4efb

Match the gradle flag description and help prose: drop the sbt-only "bare names act as exact-name filters" / "for variants" asides so both ecosystems document the include/exclude config flags identically as globs.

Jeppe Fredsgaard Blaabjerg (jfblaa) marked this pull request as ready for review June 3, 2026 10:56

Jeppe Fredsgaard Blaabjerg (jfblaa) requested a review from Martin Torp (mtorp) June 3, 2026 10:56

Martin Torp (mtorp) reviewed Jun 3, 2026

View reviewed changes

Martin Torp (mtorp) approved these changes Jun 3, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat(manifest): default to Socket facts, delegate generation to Coana CLI#1352

feat(manifest): default to Socket facts, delegate generation to Coana CLI#1352
Jeppe Fredsgaard Blaabjerg (jfblaa) wants to merge 5 commits into
v1.xfrom
jfblaa/rea-507-socket-cli-delegate-manifest-gradlescala-facts-generation-to

Jeppe Fredsgaard Blaabjerg (jfblaa) commented Jun 2, 2026 •

edited

Loading

Uh oh!

socket-security Bot commented Jun 3, 2026

Uh oh!

socket-security-staging Bot commented Jun 3, 2026

Uh oh!

Martin Torp (mtorp) left a comment

Uh oh!

Martin Torp (mtorp) Jun 3, 2026

Uh oh!

Martin Torp (mtorp) Jun 3, 2026

Uh oh!

Martin Torp (mtorp) Jun 3, 2026

Uh oh!

Martin Torp (mtorp) Jun 3, 2026

Uh oh!

Martin Torp (mtorp) left a comment

Uh oh!

Reviewers

Assignees

Labels

Milestone

Development

Uh oh!

2 participants

Conversation

Jeppe Fredsgaard Blaabjerg (jfblaa) commented Jun 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Testing

Uh oh!

socket-security Bot commented Jun 3, 2026

Uh oh!

socket-security-staging Bot commented Jun 3, 2026

Uh oh!

Martin Torp (mtorp) left a comment

Choose a reason for hiding this comment

Uh oh!

Martin Torp (mtorp) Jun 3, 2026

Choose a reason for hiding this comment

Uh oh!

Martin Torp (mtorp) Jun 3, 2026

Choose a reason for hiding this comment

Uh oh!

Martin Torp (mtorp) Jun 3, 2026

Choose a reason for hiding this comment

Uh oh!

Martin Torp (mtorp) Jun 3, 2026

Choose a reason for hiding this comment

Uh oh!

Martin Torp (mtorp) left a comment

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Milestone

Development

Uh oh!

2 participants

Jeppe Fredsgaard Blaabjerg (jfblaa) commented Jun 2, 2026 •

edited

Loading