feat(manifest): generate JVM Socket facts natively + single-run reachability sidecar (1.1.132, Coana 15.6.3)

Move the JVM build-tool resolution scripts (Gradle init script, sbt plugin, Maven
core extension) and the TypeScript SBOM assembler into socket-cli, so `socket
manifest` and `--auto-manifest` generate `.socket.facts.json` natively instead of
delegating to the Coana CLI's `manifest` command.

On `socket scan create --reach --auto-manifest` the build tool now runs exactly
once and emits both the SBOM and a resolved-paths sidecar, passed to
`coana run --compute-artifacts-sidecar`. Coana no longer re-resolves the build at
reach time, eliminating the divergence that broke dynamically-versioned projects
(git-derived versions, CI build numbers, timestamps).

Build-tool binary selection prefers the project's wrapper (./gradlew, ./mvnw) and
falls back to gradle/mvn on PATH.

Bumps @coana-tech/cli to 15.6.3, which ships `--compute-artifacts-sidecar`.

Author: jfblaa

.config/rollup.dist.config.mjs

@@ -79,6 +79,38 @@ async function copyInitGradle() {
   await fs.copyFile(filepath, destPath)
 }
 
+// Copy the JVM build-tool resolution assets (Gradle init script, sbt plugin,
+// Maven extension jar) into dist/manifest-scripts, where run.mts resolves them
+// at runtime. The Maven jar is compiled by maven-extension/build-jar.sh (run in
+// CI / local dev) and is absent from a fresh checkout — copy it only if present;
+// run.mts surfaces a build hint when it's missing.
+async function copyManifestScripts() {
+  const srcDir = path.join(constants.srcPath, 'commands/manifest/scripts')
+  const destDir = path.join(constants.distPath, 'manifest-scripts')
+  await fs.mkdir(path.join(destDir, 'maven-extension'), { recursive: true })
+  await Promise.all([
+    fs.copyFile(
+      path.join(srcDir, 'socket-facts.init.gradle'),
+      path.join(destDir, 'socket-facts.init.gradle'),
+    ),
+    fs.copyFile(
+      path.join(srcDir, 'socket-facts.plugin.scala'),
+      path.join(destDir, 'socket-facts.plugin.scala'),
+    ),
+  ])
+  const jarPath = path.join(
+    srcDir,
+    'maven-extension',
+    'coana-maven-extension.jar',
+  )
+  if (existsSync(jarPath)) {
+    await fs.copyFile(
+      jarPath,
+      path.join(destDir, 'maven-extension', 'coana-maven-extension.jar'),
+    )
+  }
+}
+
 async function copyBashCompletion() {
   const filepath = path.join(
     constants.srcPath,
@@ -464,6 +496,7 @@ export default async () => {
           async writeBundle() {
             await Promise.all([
               copyInitGradle(),
+              copyManifestScripts(),
               copyBashCompletion(),
               updatePackageJson(),
               // Remove dist/vendor.js.map file.

.github/workflows/maven-extension-jar.yml

@@ -0,0 +1,46 @@
+name: Maven extension jar
+
+# Builds (and smoke-tests) the Maven manifest extension jar in CI, separately
+# from release. Uses only allowlisted actions — notably NOT actions/setup-java
+# (the org allowlist forbids it), so it relies on a JDK pre-installed on the
+# runner via JAVA_HOME_17_X64, the same approach provenance.yml uses to build
+# the jar at release. Runs on changes to the extension and on demand.
+
+on:
+  pull_request:
+    paths:
+      - 'src/commands/manifest/scripts/maven-extension/**'
+      - 'src/commands/manifest/scripts/test/maven-compat/**'
+      - '.github/workflows/maven-extension-jar.yml'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+      - name: Build the Maven extension jar (pre-installed JDK; no setup-java)
+        run: |
+          if [ -n "${JAVA_HOME_17_X64:-}" ]; then
+            export JAVA_HOME="$JAVA_HOME_17_X64"
+          fi
+          java -version
+          bash src/commands/manifest/scripts/maven-extension/build-jar.sh
+      - name: Verify the jar was produced
+        run: test -f src/commands/manifest/scripts/maven-extension/coana-maven-extension.jar
+      - name: Smoke-test the extension on Maven 3.9.9
+        run: |
+          if [ -n "${JAVA_HOME_17_X64:-}" ]; then
+            export JAVA_HOME="$JAVA_HOME_17_X64"
+          fi
+          ver=3.9.9
+          curl -fsSL "https://archive.apache.org/dist/maven/maven-3/$ver/binaries/apache-maven-$ver-bin.zip" -o maven.zip
+          unzip -q maven.zip
+          bash src/commands/manifest/scripts/test/maven-compat/smoke-test.sh \
+            "$PWD/apache-maven-$ver/bin/mvn" \
+            "$PWD/src/commands/manifest/scripts/maven-extension/coana-maven-extension.jar"

.github/workflows/provenance.yml

@@ -204,6 +204,18 @@ jobs:
       - name: Install dependencies
         run: pnpm install --loglevel error
 
+      # Compile the Maven manifest extension jar so the dist build bundles it
+      # into dist/manifest-scripts (the jar is never committed; it ships only in
+      # the published package). The org action allowlist forbids actions/setup-java,
+      # so use a JDK pre-installed on the runner image (JAVA_HOME_17_X64), falling
+      # back to the runner's default `java`. build-jar.sh uses the Maven wrapper.
+      - name: Build Maven manifest extension jar
+        run: |
+          if [ -n "${JAVA_HOME_17_X64:-}" ]; then
+            export JAVA_HOME="$JAVA_HOME_17_X64"
+          fi
+          pnpm run build:maven-extension
+
       - run: INLINED_SOCKET_CLI_PUBLISHED_BUILD=1 pnpm run build:dist
       - name: Publish socket
         id: publish_socket

CHANGELOG.md

@@ -4,6 +4,13 @@ All notable changes to this project will be documented in this file.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
+## [1.1.132](https://github.com/SocketDev/socket-cli/releases/tag/v1.1.132) - 2026-06-30
+
+### Changed
+- More reliable reachability for Gradle, sbt, and Maven projects with dynamic versions (git versions, CI build numbers, timestamps): the build is resolved once and its artifact paths reused, avoiding spurious "failed to install" errors.
+- `socket manifest` and `--auto-manifest` now prefer your project's build-tool wrapper (`./gradlew`, `./mvnw`) when present, falling back to `gradle`/`mvn` on PATH.
+- Updated the Coana CLI to v `15.6.3`.
+
 ## [1.1.131](https://github.com/SocketDev/socket-cli/releases/tag/v1.1.131) - 2026-06-29
 
 ### Changed

package.json

@@ -1,6 +1,6 @@
 {
   "name": "socket",
-  "version": "1.1.131",
+  "version": "1.1.132",
   "description": "CLI for Socket.dev",
   "homepage": "https://github.com/SocketDev/socket-cli",
   "license": "MIT",
@@ -36,6 +36,7 @@
     "build:dist": "pnpm build:dist:src && pnpm build:dist:types",
     "build:dist:src": "run-p -c clean:dist clean:external && dotenvx -q run -f .env.local -- rollup -c .config/rollup.dist.config.mjs",
     "build:dist:types": "pnpm clean:dist:types && tsgo --project tsconfig.dts.json",
+    "build:maven-extension": "bash src/commands/manifest/scripts/maven-extension/build-jar.sh",
     "build:sea": "node src/sea/build-sea.mts",
     "build:sea:internal:bootstrap": "rollup -c .config/rollup.sea.config.mjs",
     "check": "pnpm check:lint && pnpm check:tsc",
@@ -96,7 +97,7 @@
     "@babel/preset-typescript": "7.27.1",
     "@babel/runtime": "7.28.4",
     "@biomejs/biome": "2.2.4",
-    "@coana-tech/cli": "15.6.2",
+    "@coana-tech/cli": "15.6.3",
     "@cyclonedx/cdxgen": "12.1.2",
     "@dotenvx/dotenvx": "1.49.0",
     "@eslint/compat": "1.3.2",

pnpm-lock.yaml

@@ -2,3 +2,8 @@ version: 2
 
 projectIgnorePaths:
   - "test/fixtures/"
+  # Build-tooling and test fixtures for the JVM manifest scripts, not socket-cli's
+  # own supply chain: the Maven extension's build pom and the compat-test
+  # projects' pom.xml / build.gradle / build.sbt.
+  - "src/commands/manifest/scripts/maven-extension/"
+  - "src/commands/manifest/scripts/test/"

socket.yml

@@ -6,6 +6,7 @@ import { logger } from '@socketsecurity/registry/lib/logger'
 import { convertGradleToFacts } from './convert-gradle-to-facts.mts'
 import { convertGradleToMaven } from './convert_gradle_to_maven.mts'
 import { parseBuildToolOpts } from './parse-build-tool-opts.mts'
+import { resolveBuildToolBin } from './scripts/build-tool.mts'
 import constants, { REQUIREMENTS_TXT, SOCKET_JSON } from '../../constants.mts'
 import { commonFlags } from '../../flags.mts'
 import { checkCommandInput } from '../../utils/check-input.mts'
@@ -28,7 +29,8 @@ const config: CliCommandConfig = {
     ...commonFlags,
     bin: {
       type: 'string',
-      description: 'Location of gradlew binary to use, default: CWD/gradlew',
+      description:
+        'Location of the gradle binary to use, default: ./gradlew if present, else gradle on PATH',
     },
     facts: {
       type: 'boolean',
@@ -156,7 +158,8 @@ async function run(
       bin = sockJson.defaults?.manifest?.gradle?.bin
       logger.info(`Using default --bin from ${SOCKET_JSON}:`, bin)
     } else {
-      bin = path.join(cwd, 'gradlew')
+      // Prefer the project's ./gradlew wrapper, else `gradle` on PATH.
+      bin = resolveBuildToolBin('gradle', cwd)
     }
   }
   if (!gradleOpts) {

src/commands/manifest/cmd-manifest-gradle.mts

@@ -23,7 +23,7 @@ describe('socket manifest gradle', async () => {
             $ socket manifest gradle [options] [CWD=.]
 
           Options
-            --bin               Location of gradlew binary to use, default: CWD/gradlew
+            --bin               Location of the gradle binary to use, default: ./gradlew if present, else gradle on PATH
             --exclude-configs   When generating facts: comma-separated glob patterns; Gradle configurations matching any pattern are skipped (applied after --include-configs)
             --facts             Emit a Socket facts JSON file (\`.socket.facts.json\`) describing the resolved dependency graph. This is the default; pass \`--pom\` to generate \`pom.xml\` files instead
             --gradle-opts       Additional options to pass on to ./gradlew, see \`./gradlew --help\`

src/commands/manifest/cmd-manifest-gradle.test.mts

@@ -6,6 +6,7 @@ import { logger } from '@socketsecurity/registry/lib/logger'
 import { convertGradleToFacts } from './convert-gradle-to-facts.mts'
 import { convertGradleToMaven } from './convert_gradle_to_maven.mts'
 import { parseBuildToolOpts } from './parse-build-tool-opts.mts'
+import { resolveBuildToolBin } from './scripts/build-tool.mts'
 import constants, { REQUIREMENTS_TXT, SOCKET_JSON } from '../../constants.mts'
 import { commonFlags } from '../../flags.mts'
 import { checkCommandInput } from '../../utils/check-input.mts'
@@ -33,7 +34,8 @@ const config: CliCommandConfig = {
     ...commonFlags,
     bin: {
       type: 'string',
-      description: 'Location of gradlew binary to use, default: CWD/gradlew',
+      description:
+        'Location of the gradle binary to use, default: ./gradlew if present, else gradle on PATH',
     },
     facts: {
       type: 'boolean',
@@ -161,7 +163,8 @@ async function run(
       bin = sockJson.defaults?.manifest?.gradle?.bin
       logger.info(`Using default --bin from ${SOCKET_JSON}:`, bin)
     } else {
-      bin = path.join(cwd, 'gradlew')
+      // Prefer the project's ./gradlew wrapper, else `gradle` on PATH.
+      bin = resolveBuildToolBin('gradle', cwd)
     }
   }
   if (!gradleOpts) {