Add beta Bazel JVM manifest support by simonhj · Pull Request #1312 · SocketDev/socket-cli

Simon (simonhj) · 2026-05-13T13:40:46Z

Summary

Adds beta Bazel JVM SBOM support to Socket CLI.

Bazel is multi-language, but this PR starts with Bazel + Maven because many Bazel JVM repos declare Maven dependencies through rules_jvm_external in MODULE.bazel or WORKSPACE instead of committing a manifest Socket can already scan. The extractor asks Bazel what Maven artifacts it resolved, converts that into a maven_install.json-shaped manifest, and sends it through the existing scan pipeline.

What changed

Adds socket manifest bazel [beta], a generation-only command for producing Bazel JVM SBOM manifests.
Extends socket scan create --auto-manifest so Bazel workspaces are detected automatically and scanned through the normal scan-create flow.
Detects Bazel workspaces via MODULE.bazel, WORKSPACE, or WORKSPACE.bazel.
Supports Bzlmod and legacy WORKSPACE invocation modes.
Discovers Maven repos from Bazel-visible repos / workspace metadata, including custom repo names beyond @maven.
Parses jvm_import and aar_import rules from bazel query --output=build.
Uses unsorted_deps.json when available as a faster structured source.
Writes auto-manifest output under .socket-auto-manifest/maven_install.json so we do not overwrite a repo's checked-in maven_install.json.
Adds docs, changelog entry, socket.json defaults, fixtures, and test coverage.

User flow

Generate only:

socket manifest bazel .

Generate and upload in one step:

socket scan create --auto-manifest .

Testing

Tested with unit and integration coverage for:

Bazel binary resolution.
Bzlmod vs legacy WORKSPACE detection.
Bazel query argv construction.
Maven repo discovery, including custom repo names and multi-repo cases.
jvm_import / aar_import parsing.
unsorted_deps.json parsing.
Normalization into maven_install.json.
Auto-manifest dispatch and .socket-auto-manifest/ output behavior.

Also tested against a corpus of Bazel repositories covering constructed and real-world Maven extraction cases, Bzlmod, legacy WORKSPACE, custom repo names, pinned and unpinned lockfile flows, and scan-create auto-manifest behavior.

Local checks:

git diff --check origin/v1.x
pnpm check:tsc
pnpm exec eslint --report-unused-disable-directives eslint.config.js src/commands/fix/coana-fix.mts src/commands/manifest src/commands/scan/handle-create-new-scan.mts src/commands/scan/handle-create-new-scan.test.mts src/utils/socket-json.mts vitest.config.mts
pnpm exec vitest run src/commands/manifest/bazel/bazel-bin-detect.test.mts src/commands/manifest/bazel/bazel-build-parser.test.mts src/commands/manifest/bazel/bazel-java-shim.test.mts src/commands/manifest/bazel/bazel-output-base-check.test.mts src/commands/manifest/bazel/bazel-python-shim.test.mts src/commands/manifest/bazel/bazel-query-runner.test.mts src/commands/manifest/bazel/bazel-repo-discovery.test.mts src/commands/manifest/bazel/bazel-workspace-detect.test.mts src/commands/manifest/bazel/cmd-manifest-bazel.test.mts src/commands/manifest/bazel/extract_bazel_to_maven.test.mts src/commands/manifest/bazel/generate_auto_manifest.bazel.constructed.test.mts src/commands/manifest/detect-manifest-actions.test.mts src/commands/manifest/generate_auto_manifest.test.mts src/commands/manifest/cmd-manifest.test.mts src/commands/scan/handle-create-new-scan.test.mts

Note

Medium Risk
Adds a new Bazel-based manifest generation pipeline that shells out to bazel/bazelisk, reads workspace outputs, and feeds generated files into scan create target discovery; failures or environment differences (Java/Python/Bazel setup, permissions, timeouts) could impact scan creation behavior.

Overview
Adds beta Bazel JVM SBOM support via a new socket manifest bazel subcommand that discovers rules_jvm_external Maven repos (Bzlmod and legacy WORKSPACE), runs Bazel queries / reads unsorted_deps.json, and normalizes the results into a maven_install.json-shaped manifest.

Extends socket scan create --auto-manifest to detect Bazel workspaces (MODULE.bazel, WORKSPACE, WORKSPACE.bazel), generate the Bazel manifest into a sidecar directory, and include those generated files in subsequent scan file discovery.

Introduces Bazel-specific hardening and plumbing (bazel binary resolution, Java/Python prerequisites, --output_base validation, bounded parsers/DoS guards), plus new socket.json defaults, docs/changelog updates, fixtures, and broad unit/integration test coverage.

^{Reviewed by Cursor Bugbot for commit 28ad5cb. Configure here.}

Martin Torp (mtorp)

Looks good 👏

- Remove three integration test files that depend on ~/src/bazel-bench, a local fixture not available to open-source users - Drop --json and --markdown from the manifest bazel README options since those flags are not implemented for this subcommand - Add a 10-minute timeout to bazel spawn calls to prevent CI hangs on cold-cache or stalled bazel server invocations - Cache per-attr and per-tag-key regexes at module level in bazel-build-parser to avoid recompiling on every rule block

cursor

Cursor Bugbot has reviewed your changes and found 4 potential issues.

^{Bugbot Autofix is ON. A cloud agent has been kicked off to fix the reported issues.}

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 28ad5cb. Configure here.}

Replaces ad-hoc (e as Error).message casts and instanceof Error ternaries with getErrorCause from utils/errors.mts in three catch blocks across bazel-output-base-check, bazel-repo-discovery, and extract_bazel_to_maven.

Resolves CHANGELOG.md conflict by preserving the Unreleased Bazel entries above the 1.1.94/1.1.95/1.1.96 releases that landed on v1.x while this PR was open.

Satisfies the import-x/order lint rule by moving the ../../../utils/errors.mts import after the local ./bazel-* siblings.

This PR makes Bazel manifest creation Python-aware. This builds on the Maven Bazel work from [#1312](#1312), which closes an inline-declaration gap that exists in `rules_jvm_external`: Bazel can resolve Maven artifacts that do not exist in a checked-in Maven manifest. Python is different. `rules_python` commonly resolves packages from a checked-in pinned requirements or lock file and exposes those packages as Bazel labels. It works like this: a Bazel Python rule points to a checked-in requirements file. Bazel reads that file and makes the declared packages available as dependencies in the configured pip hub. Future Bazel build targets can then directly declare dependencies on those Python packages. What this PR does is emit a generated `requirements.txt` that contains only the pinned Python packages reachable from Bazel Python rules. It does not mutate or remove entries from the user's checked-in requirements file. The value is scoping the generated manifest to Bazel's reached package set instead of assuming every checked-in requirement is used by Bazel Python targets. This functionality does not kick in automatically, since I'm not fully convinced it won't cause more harm than good or cause confusion. It has to be manually enabled with `socket manifest bazel --ecosystem pypi`. `socket scan create --auto-manifest` continues to generate Bazel Maven manifests only. ## Summary of changes - add `socket manifest bazel --ecosystem pypi` support for whole-repo Bazel PyPI `requirements.txt` generation - discover rules_python pip hubs via Bazel command output first, with bounded static fallback paths - keep Bazel PyPI generation explicit; `socket scan create --auto-manifest` continues to generate Bazel Maven only - add bounded verbose diagnostics for Bazel subprocess, discovery, extraction, and empty-result triage - document the new command surface and add exact constructed-fixture oracle coverage

Simon (simonhj) added 10 commits May 13, 2026 15:05

chore(test): support nested Bazel manifest tests

78023fb

feat(manifest/bazel): add Bazel runtime helpers

b6db505

feat(manifest/bazel): add Bazel query runner

8a534f2

feat(manifest/bazel): parse Maven artifacts from Bazel output

8d7092a

feat(manifest/bazel): discover Maven repositories

33fb2d3

feat(manifest/bazel): extract Maven install manifests

8b9d96e

feat(manifest): add Bazel manifest command

4778f0e

feat(manifest): auto-generate Bazel manifests

928e414

fix(scan): include generated auto-manifest files

f531aa4

docs(manifest): document Bazel manifest support

4c35e8a

Martin Torp (mtorp) approved these changes May 15, 2026

View reviewed changes

Comment thread src/commands/manifest/bazel/extract_bazel_to_maven.constructed.test.mts Outdated

Comment thread src/commands/manifest/README.md Outdated

Comment thread src/commands/manifest/bazel/bazel-query-runner.mts

Comment thread src/commands/manifest/bazel/bazel-build-parser.mts Outdated

Simon (simonhj) marked this pull request as ready for review May 16, 2026 12:34

cursor Bot reviewed May 16, 2026

View reviewed changes

Simon (simonhj) added 3 commits May 18, 2026 10:40

fix(manifest/bazel): use getErrorCause for error messages

f72fa6b

Replaces ad-hoc (e as Error).message casts and instanceof Error ternaries with getErrorCause from utils/errors.mts in three catch blocks across bazel-output-base-check, bazel-repo-discovery, and extract_bazel_to_maven.

Merge branch 'v1.x' into simon/bazel-manifest-cli

dcbca02

Resolves CHANGELOG.md conflict by preserving the Unreleased Bazel entries above the 1.1.94/1.1.95/1.1.96 releases that landed on v1.x while this PR was open.

fix(manifest/bazel): order parent import after siblings

37568f0

Satisfies the import-x/order lint rule by moving the ../../../utils/errors.mts import after the local ./bazel-* siblings.

Simon (simonhj) merged commit 6a005ac into v1.x May 18, 2026
12 checks passed

Simon (simonhj) deleted the simon/bazel-manifest-cli branch May 18, 2026 10:10

Simon (simonhj) mentioned this pull request May 22, 2026

Add Bazel PyPI manifest extraction #1324

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add beta Bazel JVM manifest support#1312

Add beta Bazel JVM manifest support#1312
Simon (simonhj) merged 14 commits into
v1.xfrom
simon/bazel-manifest-cli

Simon (simonhj) commented May 13, 2026 •

edited by cursor Bot

Loading

Uh oh!

Martin Torp (mtorp) left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

cursor Bot left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Milestone

Development

Uh oh!

2 participants

Conversation

Simon (simonhj) commented May 13, 2026 • edited by cursor Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

What changed

User flow

Testing

Uh oh!

Martin Torp (mtorp) left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

cursor Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Milestone

Development

Uh oh!

2 participants

Simon (simonhj) commented May 13, 2026 •

edited by cursor Bot

Loading