fix(scan): honor .socket.facts.json under --reach-use-only-pregenerated-sboms (1.1.134)

[Jeppe Fredsgaard Blaabjerg (jfblaa)]

Summary

--reach-use-only-pregenerated-sboms restricted the scan to CycloneDX/SPDX files only, so a project whose sole pre-generated SBOM was a Socket facts file (.socket.facts.json) was silently ignored by the flag.

The reachability analyzer already treats .socket.facts.json as a pre-generated SBOM — its selection matches the supported-files cdx, spdx, and socket keys. socket-cli only matched cdx/spdx, so the two were inconsistent.

This aligns socket-cli with the analyzer:

• Recognize the socket key (.socket.facts.json) as a pre-generated SBOM alongside CDX/SPDX (filterToCdxSpdxOnly → filterToPregeneratedSboms), matching leading-dot filenames with dot: true.
• Under the flag, the scan is built from the pre-generated SBOMs found in the package paths (CDX/SPDX/facts) rather than the facts-stripped list; coana's reachability report is appended once, de-duplicated so a facts input at the same path isn't uploaded twice.

Closes REA-620.

Verification

Type-check + lint clean; handle-create-new-scan and cmd-scan-create unit suites pass (39). Coana's side was audited to confirm it honors .socket.facts.json under --use-only-pregenerated-sboms (its extractPregeneratedSbomPatterns reads the cdx/spdx/socket keys).

Note for reviewers

The change to the scan-path assembly (building from packagePaths pre-generated SBOMs + de-duplicating the reachability report by resolved path) is the one spot worth a sanity check against the intended reachability-upload contract.

---

Note

Medium Risk
Changes which files are uploaded for reachability scans under --reach-use-only-pregenerated-sboms, including scan-path assembly and duplicate facts handling; behavior is intentional but worth validating against the upload contract.

Overview
--reach-use-only-pregenerated-sboms now treats Socket facts (.socket.facts.json) as a pre-generated SBOM alongside CycloneDX and SPDX, matching Coana’s --use-only-pregenerated-sboms behavior. Previously only cdx/spdx supported-files keys were used, so a repo whose only pre-generated SBOM was a facts file was effectively ignored by the flag.

In handle-create-new-scan, pre-generated SBOM filtering adds the socket key, enables micromatch dot: true so patterns like *.socket.facts.json match dotfiles, and renames the helpers to filterToPregeneratedSboms. When the flag is on, scan inputs come from those filtered paths instead of always stripping .socket.facts.json first; Coana’s reachability report is still appended once, with path de-duplication when a pre-generated facts file is the same file Coana wrote.

^{Reviewed by Cursor Bugbot for commit 4514953. Configure here.}

[Martin Torp (mtorp)]

LGTM ✅