fix(core): raise on SBOM fetch failure instead of writing empty reports (CE-362)

get_sbom_data returned {} when the full-scan stream fetch failed, so
report generation continued and produced empty GitLab dependency
scanning, license, and SARIF output with exit code 0. Raise APIFailure
instead so the failure goes through the CLI's existing API-error
handling (exit code 3 by default, still exit 0 with
--disable-blocking).

Bump the socketdev floor to 3.4.2, the bundled release that adds the
missing purl types (e.g. "generic") and per-artifact parse resilience
that caused this failure mode. Merge after socketdev 3.4.2 is on PyPI.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: lelia

pyproject.toml

@@ -16,7 +16,7 @@ dependencies = [
     'GitPython',
     'packaging',
     'python-dotenv',
-    "socketdev>=3.3.0,<4.0.0",
+    "socketdev>=3.4.2,<4.0.0",
     "bs4>=0.0.2",
     "markdown>=3.10",
     "brotli>=1.0.9; platform_python_implementation == 'CPython'",

socketsecurity/core/__init__.py

@@ -154,9 +154,13 @@ def get_sbom_data(self, full_scan_id: str) -> Dict[str, SocketArtifact]:
         """Returns SBOM artifacts for a full scan keyed by artifact ID."""
         response = self.sdk.fullscans.stream(self.config.org_slug, full_scan_id, use_types=True)
         if not response.success:
-            log.debug(f"Failed to get SBOM data for full-scan {full_scan_id}")
-            log.debug(response.message)
-            return {}
+            # Raise instead of returning {} so a failed fetch surfaces as an
+            # API error (exit code 3 by default) rather than empty reports.
+            log.error(f"Failed to get SBOM data for full-scan {full_scan_id}")
+            log.error(response.message)
+            raise APIFailure(
+                f"Failed to get SBOM data for full-scan {full_scan_id}: {response.message}"
+            )
         if not hasattr(response, "artifacts") or not response.artifacts:
             return {}
         return response.artifacts

tests/core/test_sdk_methods.py

@@ -1,5 +1,6 @@
 import pytest
-from socketdev.fullscans import FullScanParams
+from socketdev.exceptions import APIFailure
+from socketdev.fullscans import FullScanParams, FullScanStreamResponse
 
 from socketsecurity.config import CliConfig
 from socketsecurity.core import Core
@@ -263,6 +264,23 @@ def test_get_added_and_removed_packages_license_override(core):
         include_license_details="true",
     )
 
+def test_get_sbom_data_failure_raises(core):
+    """A failed SBOM stream fetch raises instead of returning {} (CE-362).
+
+    Returning {} let report generation continue and emit empty results with
+    exit code 0; raising routes the failure through the CLI's API-error
+    handling instead.
+    """
+    core.sdk.fullscans.stream.side_effect = None
+    core.sdk.fullscans.stream.return_value = FullScanStreamResponse.from_dict({
+        "success": False,
+        "status": 200,
+        "message": "Error parsing stream response",
+    })
+
+    with pytest.raises(APIFailure, match="Failed to get SBOM data"):
+        core.get_sbom_data("head")
+
 def test_empty_alerts_preserved(core):
     """Test that empty alerts arrays stay as empty arrays and don't become None"""
     # Get the scan that contains dp2 (which has empty alerts array)