Add --reach-disable-dependency-downloads

Forwards Coana's --disable-dependency-downloads (Coana 15.13.1+), which makes reachability analysis use only dependencies that are already installed and report missing ones as install failures.

Author: BarrensZeppelin

CHANGELOG.md

@@ -1,5 +1,13 @@
 # Changelog
 
+## 2.11.6
+
+### Added: `--reach-disable-dependency-downloads`
+
+- Reachability analysis uses only dependencies that are already installed (e.g.
+  in `.venv`, `vendor/` or the module cache), and reports missing ones as
+  install failures.
+
 ## 2.11.5
 
 ### Changed: bump pinned Coana CLI to 15.13.2

docs/cli-reference.md

@@ -219,7 +219,7 @@ socketcli [-h] [--api-token API_TOKEN] [--repo REPO] [--workspace WORKSPACE] [--
           [--reach] [--reach-version REACH_VERSION] [--reach-analysis-timeout REACH_ANALYSIS_TIMEOUT]
           [--reach-analysis-memory-limit REACH_ANALYSIS_MEMORY_LIMIT] [--reach-concurrency REACH_CONCURRENCY] [--reach-ecosystems REACH_ECOSYSTEMS]
           [--reach-min-severity <level>] [--reach-skip-cache] [--reach-disable-analytics] [--reach-enable-analysis-splitting] [--reach-detailed-analysis-log-file]
-          [--reach-use-only-pregenerated-sboms] [--reach-debug] [--reach-disable-external-tool-checks]
+          [--reach-use-only-pregenerated-sboms] [--reach-debug] [--reach-disable-external-tool-checks] [--reach-disable-dependency-downloads]
           [--reach-output-file REACH_OUTPUT_FILE] [--only-facts-file] [--version]
 ````
 
@@ -352,6 +352,7 @@ If you don't want to provide the Socket API Token every time then you can use th
 | `--reach-use-only-pregenerated-sboms` | False | False   | Build the scan only from pre-generated CycloneDX (CDX) and SPDX files in your project (requires --reach)                    |
 | `--reach-debug`                    | False    | False   | Enable coana debug output (`--debug`) for the analysis, independent of the global `--enable-debug`                         |
 | `--reach-disable-external-tool-checks` | False | False | Disable coana's external tool availability checks (passes `--disable-external-tool-checks`)                              |
+| `--reach-disable-dependency-downloads` | False | False | Only analyze dependencies that are already installed (e.g. in `.venv`, `vendor/` or the module cache); missing ones count as install failures (passes `--disable-dependency-downloads`) |
 | `--reach-output-file`              | False    | .socket.facts.json | Path where reachability analysis results should be saved                                                        |
 | `--reach-exclude-paths`            | False    |         | **[DEPRECATED — use `--exclude-paths`]** Comma-separated paths to exclude from reachability analysis. Still honored (unioned with `--exclude-paths`) but will be hidden in a future release |
 | `--only-facts-file`                | False    | False   | Submit only the .socket.facts.json file when creating the full scan (requires --reach)                                     |

pyproject.toml

@@ -6,7 +6,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "socketsecurity"
-version = "2.11.5"
+version = "2.11.6"
 requires-python = ">= 3.11"
 license = {"file" = "LICENSE"}
 dependencies = [

socketsecurity/__init__.py

@@ -1,3 +1,3 @@
 __author__ = 'socket.dev'
-__version__ = '2.11.5'
+__version__ = '2.11.6'
 USER_AGENT = f'SocketPythonCLI/{__version__}'

socketsecurity/config.py

@@ -222,6 +222,7 @@ class CliConfig:
     reach_continue_on_no_source_files: bool = False
     reach_debug: bool = False
     reach_disable_external_tool_checks: bool = False
+    reach_disable_dependency_downloads: bool = False
     max_purl_batch_size: int = 5000
     enable_commit_status: bool = False
     legal: bool = False
@@ -369,6 +370,7 @@ def from_args(cls, args_list: Optional[List[str]] = None) -> 'CliConfig':
             'reach_continue_on_no_source_files': args.reach_continue_on_no_source_files,
             'reach_debug': args.reach_debug,
             'reach_disable_external_tool_checks': args.reach_disable_external_tool_checks,
+            'reach_disable_dependency_downloads': args.reach_disable_dependency_downloads,
             'max_purl_batch_size': args.max_purl_batch_size,
             'enable_commit_status': args.enable_commit_status,
             'legal': args.legal or args.legal_format == "fossa",
@@ -1223,6 +1225,14 @@ def create_argument_parser() -> argparse.ArgumentParser:
         help="Disable coana's external tool availability checks during reachability analysis "
              "(passes --disable-external-tool-checks to the coana CLI)."
     )
+    reachability_group.add_argument(
+        "--reach-disable-dependency-downloads",
+        dest="reach_disable_dependency_downloads",
+        action="store_true",
+        help="Only analyze dependencies that are already installed (e.g. in the project's .venv, "
+             "vendor directory or module cache); missing ones count as install failures "
+             "(passes --disable-dependency-downloads to the coana CLI)."
+    )
 
     parser.add_argument(
         '--version',

socketsecurity/core/tools/reachability.py

@@ -124,6 +124,7 @@ def run_reachability_analysis(
         continue_on_no_source_files: bool = False,
         reach_debug: bool = False,
         disable_external_tool_checks: bool = False,
+        disable_dependency_downloads: bool = False,
     ) -> Dict[str, Any]:
         """
         Run reachability analysis.
@@ -213,6 +214,9 @@ def run_reachability_analysis(
         if disable_external_tool_checks:
             coana_args.append("--disable-external-tool-checks")
 
+        if disable_dependency_downloads:
+            coana_args.append("--disable-dependency-downloads")
+
         if use_only_pregenerated_sboms:
             coana_args.append("--use-only-pregenerated-sboms")
 

socketsecurity/socketcli.py

@@ -552,6 +552,7 @@ def main_code():
                         continue_on_no_source_files=config.reach_continue_on_no_source_files,
                         reach_debug=config.reach_debug,
                         disable_external_tool_checks=config.reach_disable_external_tool_checks,
+                        disable_dependency_downloads=config.reach_disable_dependency_downloads,
                     )
 
                     log.info("Reachability analysis completed successfully")