…diff-scans endpoints (#284)

* Poll diff-scans endpoints for scan comparison instead of streaming

The scan comparison (fullscans.stream_diff) held a single HTTP
connection open, fully idle, while the API computed the diff. Network
middleboxes with TCP idle timeouts - notably Azure NAT gateways, which
default to 4 minutes - kill that connection with a RST, surfacing as
intermittent "Connection reset by peer" / blank "API Error:" failures
on the final comparison step of long scans (CE-354).

The comparison now creates a diff-scan resource
(POST /orgs/{org}/diff-scans/from-ids) and polls
GET /orgs/{org}/diff-scans/{id}?cached=true with short bounded
requests: 202 while the diff is computing, 200 with the result once
ready. No request is ever idle long enough to be reaped, and the poll
interval backs off 5s -> 30s to stay quota-friendly (each poll costs
1 quota unit). Transient poll failures retry; a 30-minute backstop
guards against a diff scan that never completes.

Any failure of the new flow (e.g. org tokens missing the
diff-scans:create / diff-scans:list / full-scans:list scopes) logs a
warning and falls back to the legacy streaming comparison, so the
change is transparent to existing users.

Requires socketdev>=3.4.0 for diffscans.get query-param/202 support.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* Drop ignored omit_license_details param from cached diff-scan polls

The API ignores omit_license_details when cached=true - cached diff-scan
results always embed license details - so sending the param suggested a
lean-response guarantee the polling path doesn't have. Document the
caveat instead: if the heavier payload ever gets truncated on a huge
dependency tree, JSON parsing fails and the caller already falls back
to the legacy streaming comparison, which still requests the lean
payload. include_license_details now only governs that fallback call.

Flagged by Cursor Bugbot on #284.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* Keep duplicate diff scans on cached polling

* Require bundled socketdev 3.4.2 release

* Stage CLI 2.6.1

* Require socketdev 3.5.0

* Drop ticket references from code comments, workflows, and changelog

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Signed-off-by: lelia <2418071+lelia@users.noreply.github.com>

* Align changelog with pinned SDK dependency

---------

Signed-off-by: lelia <2418071+lelia@users.noreply.github.com>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

* fix(core): raise on SBOM fetch failure instead of writing empty reports (CE-362)

get_sbom_data returned {} when the full-scan stream fetch failed, so
report generation continued and produced empty GitLab dependency
scanning, license, and SARIF output with exit code 0. Raise APIFailure
instead so the failure goes through the CLI's existing API-error
handling (exit code 3 by default, still exit 0 with
--disable-blocking).

Bump the socketdev floor to 3.4.2, the bundled release that adds the
missing purl types (e.g. "generic") and per-artifact parse resilience
that caused this failure mode. Merge after socketdev 3.4.2 is on PyPI.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* chore: lock socketdev 3.4.2

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* chore: bump version to 2.5.11

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* ci(e2e): retry reachability on empty results, upload diagnostics on failure

The e2e-reachability job intermittently fails with 'no components with
alerts in .socket.facts.json': the tier-1 reachability backend can
return empty results while the CLI reports success (ENG-5093), and the
same flake has hit unrelated PRs.

- Add a retry-probe hook to the e2e matrix: entries that define it get
  up to 3 scan attempts, retrying only when the probe says the output
  looks incomplete. Persistent failures still fail via the validate
  step. Each retry emits a warning annotation and a step-summary line
  so flake frequency stays visible.
- Add tests/e2e/reach-facts-probe.sh: exits 0 when the facts file has
  alerted components, non-zero (retry) when empty or missing.
- Upload /tmp/e2e-output.log, SARIF/GitLab outputs, and facts files as
  artifacts when any e2e job fails, so flakes are diagnosable without
  a re-run.

Also bump version to 2.6.2 (2.6.0 and 2.6.1 are being released ahead
of this PR).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* chore: require socketdev 3.5.0

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* Drop ticket references from e2e comments and note the retry hardening in the changelog

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Signed-off-by: lelia <2418071+lelia@users.noreply.github.com>

* Move e2e retry changelog entry out and drop remaining ticket reference

The e2e retry hardening ships with the dependency pinning PR instead,
so its changelog entry moves there.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Signed-off-by: lelia <2418071+lelia@users.noreply.github.com>

* docs: changelog phrasing tweak

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

---------

Signed-off-by: lelia <2418071+lelia@users.noreply.github.com>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

Bumps [actions/setup-python](https://github.com/actions/setup-python) from 6.2.0 to 7.0.0.
- [Release notes](https://github.com/actions/setup-python/releases)
- [Commits](actions/setup-python@a309ff8...5fda3b9)

---
updated-dependencies:
- dependency-name: actions/setup-python
  dependency-version: 7.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: lelia <2418071+lelia@users.noreply.github.com>

…#296)

* chore(deps): bump twine from 6.2.0 to 7.0.0 in the python-major group

Bumps the python-major group with 1 update: [twine](https://github.com/pypa/twine).


Updates `twine` from 6.2.0 to 7.0.0
- [Release notes](https://github.com/pypa/twine/releases)
- [Changelog](https://github.com/pypa/twine/blob/main/docs/changelog.rst)
- [Commits](pypa/twine@6.2.0...7.0.0)

---
updated-dependencies:
- dependency-name: twine
  dependency-version: 7.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: python-major
...

Signed-off-by: dependabot[bot] <support@github.com>

* Pin dev and test extras to exact versions

Runtime dependencies were pinned exactly in 2.6.0; this applies the
same policy to the dev and test extras (matching the currently locked
versions, including the twine 7.0.0 bump from this PR) so future
dependency updates surface in pyproject.toml rather than only in
uv.lock.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: lelia <2418071+lelia@users.noreply.github.com>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

…ies with 4 updates (#292)

Bumps the github-actions-minor-patch group with 1 update in the / directory: [pypa/gh-action-pypi-publish](https://github.com/pypa/gh-action-pypi-publish).
Bumps the github-actions-minor-patch group with 3 updates in the /.github/actions/setup-docker directory: [docker/setup-qemu-action](https://github.com/docker/setup-qemu-action), [docker/setup-buildx-action](https://github.com/docker/setup-buildx-action) and [docker/login-action](https://github.com/docker/login-action).


Updates `pypa/gh-action-pypi-publish` from 1.14.1 to 1.14.2
- [Release notes](https://github.com/pypa/gh-action-pypi-publish/releases)
- [Commits](pypa/gh-action-pypi-publish@v1.14.1...dc37677)

Updates `docker/setup-qemu-action` from 4.1.0 to 4.2.0
- [Release notes](https://github.com/docker/setup-qemu-action/releases)
- [Commits](docker/setup-qemu-action@0611638...96fe6ef)

Updates `docker/setup-buildx-action` from 4.1.0 to 4.2.0
- [Release notes](https://github.com/docker/setup-buildx-action/releases)
- [Commits](docker/setup-buildx-action@d7f5e7f...bb05f3f)

Updates `docker/login-action` from 4.2.0 to 4.6.0
- [Release notes](https://github.com/docker/login-action/releases)
- [Commits](docker/login-action@650006c...dbcb813)

---
updated-dependencies:
- dependency-name: pypa/gh-action-pypi-publish
  dependency-version: 1.14.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-actions-minor-patch
- dependency-name: docker/setup-qemu-action
  dependency-version: 4.2.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions-minor-patch
- dependency-name: docker/setup-buildx-action
  dependency-version: 4.2.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions-minor-patch
- dependency-name: docker/login-action
  dependency-version: 4.6.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions-minor-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: lelia <2418071+lelia@users.noreply.github.com>

Bumps [actions/setup-python](https://github.com/actions/setup-python) from 6.2.0 to 7.0.0.
- [Release notes](https://github.com/actions/setup-python/releases)
- [Commits](actions/setup-python@a309ff8...5fda3b9)

---
updated-dependencies:
- dependency-name: actions/setup-python
  dependency-version: 7.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: lelia <2418071+lelia@users.noreply.github.com>

Bumps the python-minor-patch group with 3 updates: [beautifulsoup4](https://www.crummy.com/software/BeautifulSoup/bs4/), [markdown](https://github.com/Python-Markdown/markdown) and [ruff](https://github.com/astral-sh/ruff).


Updates `beautifulsoup4` from 4.14.3 to 4.15.0

Updates `markdown` from 3.10.2 to 3.10.3
- [Release notes](https://github.com/Python-Markdown/markdown/releases)
- [Changelog](https://github.com/Python-Markdown/markdown/blob/master/docs/changelog.md)
- [Commits](Python-Markdown/markdown@3.10.2...3.10.3)

Updates `ruff` from 0.16.0 to 0.16.1
- [Release notes](https://github.com/astral-sh/ruff/releases)
- [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md)
- [Commits](astral-sh/ruff@0.16.0...0.16.1)

---
updated-dependencies:
- dependency-name: beautifulsoup4
  dependency-version: 4.15.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-minor-patch
- dependency-name: markdown
  dependency-version: 3.10.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-minor-patch
- dependency-name: ruff
  dependency-version: 0.16.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-minor-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: lelia <2418071+lelia@users.noreply.github.com>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

* Bump pinned @coana-tech/cli to 15.10.4

* Rev version to 2.6.3, consolidating the unpublished 2.6.2 notes

2.6.1 shipped while this PR was in flight, and the 2.6.2 version bump on
main was never published. Fold the 2.6.2 changelog entry, the Dependabot
updates, and the dev/test dependency pinning into the 2.6.3 entry.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* Trim dependency-update specifics in the 2.6.3 changelog entry

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

---------

Co-authored-by: socket-pr-bot[bot] <294242679+socket-pr-bot[bot]@users.noreply.github.com>
Co-authored-by: lelia <2418071+lelia@users.noreply.github.com>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

* Bump pinned @coana-tech/cli to 15.10.13

* Bump pinned GitPython to 3.1.59

GitPython 3.1.57 is affected by six advisories fixed in 3.1.58
(published 2026-08-07) and five more fixed in 3.1.59 (published
2026-08-10). Pin the latest so the pip-audit gate stays green once the
newer advisories propagate to the audit databases. None of the affected
GitPython APIs are used by this CLI.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Signed-off-by: lelia <2418071+lelia@users.noreply.github.com>

---------

Signed-off-by: lelia <2418071+lelia@users.noreply.github.com>
Co-authored-by: socket-pr-bot[bot] <294242679+socket-pr-bot[bot]@users.noreply.github.com>
Co-authored-by: lelia <2418071+lelia@users.noreply.github.com>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

Co-authored-by: socket-pr-bot[bot] <294242679+socket-pr-bot[bot]@users.noreply.github.com>

* perf(core): discover manifests in a single filesystem walk

find_files() started a separate recursive rglob traversal for every expanded
manifest pattern, so a scan re-walked each root once per pattern and only
filtered excluded directories after descending into them. Replace that with one
os.walk() per scan root:

- Expand and case-fold all active patterns once, then match in memory.
- Prune excluded directories, including .git, before descending.
- Reject non-manifests on the basename alone (one set lookup plus one compiled
  glob alternation) before building a relative path or running a path match.
- Cache supported manifest patterns per Core instance, but only when the API
  lookup succeeds, so a transient failure does not pin the run to the smaller
  local fallback pattern set.
- Emit INFO durations for organization setup, pattern retrieval and discovery,
  with files/directories visited, directories pruned and manifests found.

Matching behaviour is unchanged apart from intentionally excluding .git
metadata. Adds parity tests against the previous rglob implementation for every
built-in ecosystem and pattern, covering case-insensitivity, brace expansion,
nested patterns, dot-directories, exclusions, inclusions, symlinks, excluded
ecosystems, multiple roots, sorting and deduplication, plus an opt-in benchmark
that asserts old/new result equality on a synthetic large-monorepo fixture.

Ref: CE-379

* perf(git): fetch only the refs a comparison needs

Git.__init__() ran `git fetch --all` on every invocation, pulling every remote
branch and tag before changed-file detection even began. Resolve commit and
branch metadata locally instead, and for pull-request comparisons prefer refs
already present in the checkout, fetching a single base or head ref only when it
is missing.

Also recognises Buildkite's native BUILDKITE_COMMIT, BUILDKITE_BRANCH,
BUILDKITE_PULL_REQUEST and BUILDKITE_PULL_REQUEST_BASE_BRANCH so Buildkite jobs
can calculate a complete base-to-head changed-file range without mapping their
environment onto GitHub Actions variable names. Buildkite is checked before
GitHub because some pipelines deliberately export GitHub-compatible variables.

Adds INFO durations for Git initialisation, changed-file detection and each
fetch, including the ref requested and why. Existing GitHub Actions, GitLab CI,
Bitbucket Pipelines and local behaviour is preserved; tests cover local-ref
preference, absence of an unconditional fetch, the targeted-fetch fallback, all
four CI providers, and non-PR and detached-HEAD execution.

Ref: CE-379

* feat(buildkite): derive GitHub comment context natively

`--scm github` read its configuration solely from GITHUB_* variables, so
Buildkite users had to shim every one of them to get PR comments. Fall back to
Buildkite's own variables when the GITHUB_* equivalents are absent: PR number,
commit, branch, checkout path, commit message, build creator, and owner/repository
parsed from BUILDKITE_REPO (preferring the pipeline repository over a
contributor's fork). Explicit GITHUB_* and PR_NUMBER values still take priority,
and GitHub Enterprise remains configurable via GITHUB_API_URL.

A running Buildkite PR build maps to the supported `synchronize` comment path,
and a non-PR build maps to `push`, so event routing is unchanged. Default-branch
detection requires an actual branch name rather than treating two unset variables
as a match, which would otherwise mark any build as the default branch and
overwrite the repository baseline.

Ref: CE-379

* refactor(cli): reuse sub-path discovery results and clarify scan routing

The --sub-path routing pre-check walked every selected path to decide whether any
manifests existed, then discarded the result so scan creation walked the same
paths again. Retain and reuse it.

Apply --excluded-ecosystems before the pre-check rather than after, so every
find_files() call in a run sees the same ecosystem filter.

Add an INFO duration for CLI run registration, and replace the
"No Manifest files changed" line with wording that describes the decision being
made: no supported manifest was detected in the changed-file set, so a full
report is created. Scan-routing semantics are unchanged.

Ref: CE-379

* docs(changelog): note faster local scan setup for large repositories

Ref: CE-379

* chore(release): bump version to 2.6.5

Bumped via .hooks/sync_version.py so __init__.py, pyproject.toml and uv.lock
stay in sync, and moved the changelog entry under a 2.6.5 heading.

Ref: CE-379

* fix(ci): build the Docker preview from the checked-out workspace

The publish-docker job downloads the built wheel to ./dist, but the build step
omitted `context`, so docker/build-push-action used its default Git context.
Buildx then cloned the repository as the build context, where ./dist does not
exist, and `COPY dist/socketsecurity-*.whl` failed with
"lstat /dist: no such file or directory".

Set `context: .` so the build uses the workspace the artifact was downloaded
into. This also makes the job's existing trust boundary hold as documented: the
context is now the default-branch checkout rather than the pull-request ref, so
Dockerfile.preview is read from trusted code and the pull request still enters
the image only through the built wheel.

Pre-existing; the TestPyPI half of the workflow is unaffected.

* ci(preview): build Docker previews for arm64 as well as amd64

The preview image was amd64-only while the release and stable images are built
for linux/amd64,linux/arm64, so a preview tag could not stand in for
socketdev/cli:latest on arm64 hosts without emulation.

Match the release arch matrix and enable QEMU so the arm64 layer can be built on
an amd64 runner. Previews are opt-in via label, so the extra build time is an
acceptable tradeoff for making the tag a drop-in replacement.

* perf(diff): tighten diff-scan poll ceiling and make its timing attributable

A finished comparison could sit unobserved for up to 30s between polls, which is
dead time on every PR job. Lower the ceiling to 10s: a multi-minute comparison
costs roughly 2x the polls while cutting worst-case dead time to 10s.

Diff scans now log their ID, poll count, and the wait before the final poll at
INFO. Previously the ID was debug-only, so a slow comparison in a customer CI log
could not be tied back to a server-side diff scan, and there was no way to tell
backend comparison time apart from time the result spent ready-but-unpolled.

Also document the diff-scans token scopes. A token missing them still completes
the scan, silently falling back to the streaming comparison, which differs in both
transport and payload (cached diff-scan responses always embed per-package license
details; the streaming path requests a lean payload).

Ref: CE-379

* feat(diff): log the diff report URL and cover discovery memory

PR/MR runs logged the head and new scan IDs but no link to the result, so a CI log
gave no way to reach the report. Log the diff report URL where it is computed, so
every diff flow gets it rather than only the full-scan-only branches.

Also add a regression test asserting manifest discovery's peak allocation stays
bounded by the widest single directory and the result set rather than by repository
size. Measured against the per-pattern rglob approach this replaced, on a tree of
59,300 files including one 50,000-entry directory: 3.25 MB peak vs 10.72 MB.
os.walk keeps a list of names per directory where rglob materialised DirEntry
objects and a Path per candidate, so the single-pass walk allocates strictly less.

Ref: CE-379

* docs(diff): record verified cached diff-scan param behaviour

Probed the live API against an existing diff scan to confirm what the polling path
can and cannot ask for:

- omit_license_details is ignored when cached=true, as the existing comment said.
  License fields remain in the response.
- omit_unchanged IS honored and removes unchanged artifacts entirely, measured at
  ~1.1 KB per artifact (225,542 B -> 78,003 B when dropping 135 of 192 artifacts).

Record why the CLI still does not send omit_unchanged: unchanged artifacts feed
diff.unchanged_alerts, which create_security_comment_gitlab and the FOSSA compat
issue list read unconditionally, not only under --strict-blocking. Omitting them
would silently shrink those outputs, so this needs proper gating in its own change
rather than a param tweak here.

Ref: CE-379

* perf(diff): skip unchanged artifacts when no output reads them

Cached diff-scan responses embed every unchanged artifact at roughly 1 KB each. On
a large dependency tree that is nearly the whole response — measured at ~11 MB for
a tree with ~10k unchanged packages — downloaded, deserialised into Package objects
and then discarded on every pull request.

omit_unchanged is honored by the API (unlike omit_license_details, which cached
responses ignore), so request it whenever no enabled output reads that half of the
comparison. Verified against the live API through the SDK: 192 artifacts -> 57.

Every consumer is behind an opt-in flag, so the gate is centralised in
Core._requires_unchanged_artifacts with the reasoning recorded there:

- --strict-blocking blocks on pre-existing issues via diff.unchanged_alerts
- --enable-gitlab-security includes them in the dependency scanning report
- --generate-license enumerates diff.packages, which must list every dependency
- --legal-format fossa reports all currently-present issues

Diff.to_dict serialises them too but has no callers. When cli_config is absent the
caller is unknown, so the full payload is kept.

Tests parametrise over every flag in that list so a new reader of
diff.unchanged_alerts or diff.packages cannot be added without also updating the
gate. The completion log reports omit_unchanged so it is visible whether the
optimisation engaged on a given run.

Ref: CE-379

* chore(release): bump version to 2.6.6

* fix: always filter diff scan artifacts

* fix: preserve directory-only manifest patterns

Address peer review feedback by retaining pathlib.rglob trailing-slash semantics, trimming the release notes, and removing redundant implementation commentary.