Raise failure on SBOM fetch errors (#288)

* fix(core): raise on SBOM fetch failure instead of writing empty reports (CE-362)

get_sbom_data returned {} when the full-scan stream fetch failed, so
report generation continued and produced empty GitLab dependency
scanning, license, and SARIF output with exit code 0. Raise APIFailure
instead so the failure goes through the CLI's existing API-error
handling (exit code 3 by default, still exit 0 with
--disable-blocking).

Bump the socketdev floor to 3.4.2, the bundled release that adds the
missing purl types (e.g. "generic") and per-artifact parse resilience
that caused this failure mode. Merge after socketdev 3.4.2 is on PyPI.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* chore: lock socketdev 3.4.2

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* chore: bump version to 2.5.11

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* ci(e2e): retry reachability on empty results, upload diagnostics on failure

The e2e-reachability job intermittently fails with 'no components with
alerts in .socket.facts.json': the tier-1 reachability backend can
return empty results while the CLI reports success (ENG-5093), and the
same flake has hit unrelated PRs.

- Add a retry-probe hook to the e2e matrix: entries that define it get
  up to 3 scan attempts, retrying only when the probe says the output
  looks incomplete. Persistent failures still fail via the validate
  step. Each retry emits a warning annotation and a step-summary line
  so flake frequency stays visible.
- Add tests/e2e/reach-facts-probe.sh: exits 0 when the facts file has
  alerted components, non-zero (retry) when empty or missing.
- Upload /tmp/e2e-output.log, SARIF/GitLab outputs, and facts files as
  artifacts when any e2e job fails, so flakes are diagnosable without
  a re-run.

Also bump version to 2.6.2 (2.6.0 and 2.6.1 are being released ahead
of this PR).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* chore: require socketdev 3.5.0

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* Drop ticket references from e2e comments and note the retry hardening in the changelog

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Signed-off-by: lelia <2418071+lelia@users.noreply.github.com>

* Move e2e retry changelog entry out and drop remaining ticket reference

The e2e retry hardening ships with the dependency pinning PR instead,
so its changelog entry moves there.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Signed-off-by: lelia <2418071+lelia@users.noreply.github.com>

* docs: changelog phrasing tweak

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

---------

Signed-off-by: lelia <2418071+lelia@users.noreply.github.com>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

Author: lelia

CHANGELOG.md

@@ -1,5 +1,18 @@
 # Changelog
 
+## 2.6.2
+
+### Fixed: SBOM fetch failures no longer produce empty reports
+
+- `Core.get_sbom_data` now raises `APIFailure` when the full-scan stream fetch
+  fails, so the run exits through the CLI's API-error handling (exit code 3 by
+  default; `--disable-blocking` still exits 0) instead of writing empty
+  GitLab dependency-scanning, license, and SARIF reports.
+- The underlying stream-parse failure was fixed in `socketdev` 3.4.2 (already
+  pinned to `3.5.0`): unrecognized purl types such as `generic` now resolve
+  instead of raising, and individual unparseable artifacts are skipped rather
+  than failing the whole response.
+
 ## 2.6.1
 
 ### Changed: scan comparison now polls the diff-scans endpoints

pyproject.toml

@@ -6,7 +6,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "socketsecurity"
-version = "2.6.1"
+version = "2.6.2"
 requires-python = ">= 3.11"
 license = {"file" = "LICENSE"}
 dependencies = [

socketsecurity/__init__.py

@@ -1,3 +1,3 @@
 __author__ = 'socket.dev'
-__version__ = '2.6.1'
+__version__ = '2.6.2'
 USER_AGENT = f'SocketPythonCLI/{__version__}'

socketsecurity/core/__init__.py

@@ -173,9 +173,13 @@ def get_sbom_data(self, full_scan_id: str) -> Dict[str, SocketArtifact]:
         """Returns SBOM artifacts for a full scan keyed by artifact ID."""
         response = self.sdk.fullscans.stream(self.config.org_slug, full_scan_id, use_types=True)
         if not response.success:
-            log.debug(f"Failed to get SBOM data for full-scan {full_scan_id}")
-            log.debug(response.message)
-            return {}
+            # Raise instead of returning {} so a failed fetch surfaces as an
+            # API error (exit code 3 by default) rather than empty reports.
+            log.error(f"Failed to get SBOM data for full-scan {full_scan_id}")
+            log.error(response.message)
+            raise APIFailure(
+                f"Failed to get SBOM data for full-scan {full_scan_id}: {response.message}"
+            )
         if not hasattr(response, "artifacts") or not response.artifacts:
             return {}
         return response.artifacts

tests/core/test_sdk_methods.py

@@ -1,5 +1,6 @@
 import pytest
-from socketdev.fullscans import FullScanParams
+from socketdev.exceptions import APIFailure
+from socketdev.fullscans import FullScanParams, FullScanStreamResponse
 
 from socketsecurity.config import CliConfig
 from socketsecurity.core import Core
@@ -277,6 +278,23 @@ def test_get_added_and_removed_packages_license_override(core):
         include_license_details="true",
     )
 
+def test_get_sbom_data_failure_raises(core):
+    """A failed SBOM stream fetch raises instead of returning {}.
+
+    Returning {} let report generation continue and emit empty results with
+    exit code 0; raising routes the failure through the CLI's API-error
+    handling instead.
+    """
+    core.sdk.fullscans.stream.side_effect = None
+    core.sdk.fullscans.stream.return_value = FullScanStreamResponse.from_dict({
+        "success": False,
+        "status": 200,
+        "message": "Error parsing stream response",
+    })
+
+    with pytest.raises(APIFailure, match="Failed to get SBOM data"):
+        core.get_sbom_data("head")
+
 def test_empty_alerts_preserved(core):
     """Test that empty alerts arrays stay as empty arrays and don't become None"""
     # Get the scan that contains dp2 (which has empty alerts array)