Add beta Bazel JVM manifest support by simonhj · Pull Request #1312 · SocketDev/socket-cli

Simon (simonhj) · 2026-05-13T13:40:46Z

Summary

Adds beta Bazel JVM SBOM support to Socket CLI.

Bazel is multi-language, but this PR starts with Bazel + Maven because many Bazel JVM repos declare Maven dependencies through rules_jvm_external in MODULE.bazel or WORKSPACE instead of committing a manifest Socket can already scan. The extractor asks Bazel what Maven artifacts it resolved, converts that into a maven_install.json-shaped manifest, and sends it through the existing scan pipeline.

What changed

Adds socket manifest bazel [beta], a generation-only command for producing Bazel JVM SBOM manifests.
Extends socket scan create --auto-manifest so Bazel workspaces are detected automatically and scanned through the normal scan-create flow.
Detects Bazel workspaces via MODULE.bazel, WORKSPACE, or WORKSPACE.bazel.
Supports Bzlmod and legacy WORKSPACE invocation modes.
Discovers Maven repos from Bazel-visible repos / workspace metadata, including custom repo names beyond @maven.
Parses jvm_import and aar_import rules from bazel query --output=build.
Uses unsorted_deps.json when available as a faster structured source.
Writes auto-manifest output under .socket-auto-manifest/maven_install.json so we do not overwrite a repo's checked-in maven_install.json.
Adds docs, changelog entry, socket.json defaults, fixtures, and test coverage.

User flow

Generate only:

socket manifest bazel .

Generate and upload in one step:

socket scan create --auto-manifest .

Testing

Tested with unit and integration coverage for:

Bazel binary resolution.
Bzlmod vs legacy WORKSPACE detection.
Bazel query argv construction.
Maven repo discovery, including custom repo names and multi-repo cases.
jvm_import / aar_import parsing.
unsorted_deps.json parsing.
Normalization into maven_install.json.
Auto-manifest dispatch and .socket-auto-manifest/ output behavior.

Also tested against a corpus of Bazel repositories covering constructed and real-world Maven extraction cases, Bzlmod, legacy WORKSPACE, custom repo names, pinned and unpinned lockfile flows, and scan-create auto-manifest behavior.

Local checks:

git diff --check origin/v1.x
pnpm check:tsc
pnpm exec eslint --report-unused-disable-directives eslint.config.js src/commands/fix/coana-fix.mts src/commands/manifest src/commands/scan/handle-create-new-scan.mts src/commands/scan/handle-create-new-scan.test.mts src/utils/socket-json.mts vitest.config.mts
pnpm exec vitest run src/commands/manifest/bazel/bazel-bin-detect.test.mts src/commands/manifest/bazel/bazel-build-parser.test.mts src/commands/manifest/bazel/bazel-java-shim.test.mts src/commands/manifest/bazel/bazel-output-base-check.test.mts src/commands/manifest/bazel/bazel-python-shim.test.mts src/commands/manifest/bazel/bazel-query-runner.test.mts src/commands/manifest/bazel/bazel-repo-discovery.test.mts src/commands/manifest/bazel/bazel-workspace-detect.test.mts src/commands/manifest/bazel/cmd-manifest-bazel.test.mts src/commands/manifest/bazel/extract_bazel_to_maven.test.mts src/commands/manifest/bazel/generate_auto_manifest.bazel.constructed.test.mts src/commands/manifest/detect-manifest-actions.test.mts src/commands/manifest/generate_auto_manifest.test.mts src/commands/manifest/cmd-manifest.test.mts src/commands/scan/handle-create-new-scan.test.mts

Martin Torp (mtorp)

Looks good 👏

Martin Torp (mtorp) · 2026-05-15T07:13:59Z

+const FIXTURE = path.join(
+  process.env['HOME'] as string,
+  'src',
+  'bazel-bench',
+  'constructed',
+  'java-maven',
+)


Looks like this may be a reference to a local path. Is than intentional?

Good catch. All three test files referencing ~/src/bazel-bench have been removed — they depended on a local fixture not available to open-source users.

Martin Torp (mtorp) · 2026-05-15T07:19:22Z

+- `--bazel-flags <str>` — flags forwarded to every bazel invocation (single quoted string).
+- `--bazel-output-base <dir>` — Bazel `--output_base` for read-only-cache CI environments.
+- `--out <dir>` — output directory; default `./.socket/bazel-manifests/`.
+- `--dry-run`, `--verbose`, `--json`, `--markdown` — standard diagnostic flags.


Claude says --json and --markdown aren't implemented for this subcommand. They're probably not necessary, so I suggest removing them from this readme.

Removed --json and --markdown from the options list.

Martin Torp (mtorp) · 2026-05-15T07:23:58Z

+    const output = await spawn(opts.bin, argv, {
+      cwd: opts.cwd,
+      ...(opts.env ? { env: opts.env } : {}),
+    })


How long do Bazel queries typically take to execute? Would it make sense to add some default generous timeout to this operation just in case it hangs in a CI run for whatever reason.

Added a BAZEL_QUERY_TIMEOUT_MS = 600_000 (10 min) constant and passed it to both spawn() calls. Bazel cold-cache starts can take a few minutes; 10 min should be generous without letting a hung server block CI indefinitely.

Martin Torp (mtorp) · 2026-05-15T07:25:19Z

+function extractAttr(body: string, attr: string): string | undefined {
+  // Match `<attr> = "VALUE"` — quoted-string attrs only.
+  // Quoted value capped at 4 KiB; canonical Maven URLs are ~150 bytes.
+  const re = new RegExp(`\\b${attr}\\s*=\\s*"([^"\\n]{0,4096})"`)


I suggest moving the regex construction out of the function body to avoid having to recreate it at every call.

Done. Added ATTR_RE_CACHE and TAG_RE_CACHE Maps at module level; both extractAttr and extractTagValue now check the cache before constructing a new regex.

- Remove three integration test files that depend on ~/src/bazel-bench, a local fixture not available to open-source users - Drop --json and --markdown from the manifest bazel README options since those flags are not implemented for this subcommand - Add a 10-minute timeout to bazel spawn calls to prevent CI hangs on cold-cache or stalled bazel server invocations - Cache per-attr and per-tag-key regexes at module level in bazel-build-parser to avoid recompiling on every rule block

Simon (simonhj) added 10 commits May 13, 2026 15:05

chore(test): support nested Bazel manifest tests

78023fb

feat(manifest/bazel): add Bazel runtime helpers

b6db505

feat(manifest/bazel): add Bazel query runner

8a534f2

feat(manifest/bazel): parse Maven artifacts from Bazel output

8d7092a

feat(manifest/bazel): discover Maven repositories

33fb2d3

feat(manifest/bazel): extract Maven install manifests

8b9d96e

feat(manifest): add Bazel manifest command

4778f0e

feat(manifest): auto-generate Bazel manifests

928e414

fix(scan): include generated auto-manifest files

f531aa4

docs(manifest): document Bazel manifest support

4c35e8a

Martin Torp (mtorp) approved these changes May 15, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add beta Bazel JVM manifest support#1312

Add beta Bazel JVM manifest support#1312
Simon (simonhj) wants to merge 11 commits into
v1.xfrom
simon/bazel-manifest-cli

Simon (simonhj) commented May 13, 2026

Uh oh!

Martin Torp (mtorp) left a comment

Uh oh!

Martin Torp (mtorp) May 15, 2026

Uh oh!

Simon (simonhj) May 15, 2026

Uh oh!

Martin Torp (mtorp) May 15, 2026

Uh oh!

Simon (simonhj) May 15, 2026

Uh oh!

Martin Torp (mtorp) May 15, 2026

Uh oh!

Simon (simonhj) May 15, 2026

Uh oh!

Martin Torp (mtorp) May 15, 2026

Uh oh!

Simon (simonhj) May 15, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

Simon (simonhj) commented May 13, 2026

Summary

What changed

User flow

Testing

Uh oh!

Martin Torp (mtorp) left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants