[Jeppe Fredsgaard Blaabjerg (jfblaa)]

LLM Description written by Claude Code:claude-opus-5-5

--dynamic-sbom-inference only discovered Maven builds through files named exactly pom.xml. A scan uploads more POMs than that: depscan's supported-file pattern for POMs is {*-*.,}pom{.xml,}, matched case-insensitively. Those other POMs were uploaded without a facts build. Discovery now follows the upload rules.

• Same POMs as the upload: the same pattern, case-insensitive, honouring .gitignore and now also projectIgnorePaths in socket.yml, as the upload does. A POM a scan would not upload is not built either.
• One build per POM: a directory can hold several builds. A POM other than pom.xml runs with mvn --file <pom>, and its facts file is named after it (<pom>.socket.facts.json). Coverage by a parent build is judged per file, so a covered POM doesn't hide an uncovered sibling.
• --exclude-paths unchanged: it stays case-sensitive; only the POM name match ignores case.
• Setup wizard (socket manifest setup --recursive): asks once per directory holding several POMs. It no longer disables a whole directory when --exclude-paths matches only one of its POMs, and warns instead.

Things to be aware of:

• Published artifact POMs (<artifactId>-<version>.pom) are now built too, because depscan accepts them. An in-tree Maven repository (e.g. a project-local .m2/repository) is skipped when gitignored or listed in projectIgnorePaths; otherwise use --exclude-paths. A POM that fails to build still stops the remaining Maven builds in the run, as before.
• The pattern is copied from the API's supported files rather than fetched, since socket manifest runs without the API.

Tested:

• New unit tests for discovery (names, case, .gitignore, projectIgnorePaths, --exclude-paths), per-POM runs and coverage, and the wizard.
• A real run on a project with pom.xml, app-dev.pom.xml, a bare pom and a gitignored .m2 artifact POM produced three facts files, each from its own POM.

🤖 Generated with Claude Code

---

Note

Medium Risk
Changes Maven discovery and how many mvn invocations run (including vendored/artifact POMs), which can increase build time or fail the whole Maven walk on a bad POM; behavior is well-covered by tests but may surprise repos that previously only built pom.xml.

Overview
--dynamic-sbom-inference now treats Maven like a scan upload: discovery uses the same POM filename pattern (pom.xml, *.pom, *.pom.xml, bare pom, case-insensitive) and skips paths ignored by .gitignore or socket.yml projectIgnorePaths.

Build discovery returns BuildRoot objects (dir + optional entryFile) instead of directories only. Each matching POM is a separate Maven build; non-default files run with mvn --file, and reactor coverage is per POM file so one covered sibling does not hide another in the same folder.

The recursive manifest generator, DSI output, and socket manifest setup --recursive follow the same model: withEntryFileOpts prepends --file, partial --exclude-paths no longer disables an entire directory when another POM there stays included (with a warning), and the setup wizard prompts once per directory for multiple POMs.

^{Reviewed by Cursor Bugbot for commit 386e1a7. Configure here.}

[Oskar Haarklou Veileborg (BarrensZeppelin)]

Simplification pass, no correctness findings. Comments are suggestions; none block.

[Oskar Haarklou Veileborg (BarrensZeppelin)]

Second simplification pass, on f7ae575. Most of the first round is addressed, thanks.

One correction first: in the last review I said moving discovery to **/* with a filter "shouldn't get slower". That was wrong. See the comment on the glob call. Directories walked are the same, but per-file matching cost goes up.

Outside this PR, for later: scanBuildRoots runs discovery twice even with no --exclude-paths. globWithGitIgnore could run filter before the !-pattern chain check. The scriptOpts builders in run-manifest-facts.mts and enumerate-workspaces.mts duplicate each other.

[Oskar Haarklou Veileborg (BarrensZeppelin)]

LGTM ✅