fix(manifest): report the Gradle failures the facts init script swallowed

Dependency-verification failures, failed project dependencies, modules
whose artifacts cannot be listed and jars that cannot be fetched all
reached the facts as healthy or vanished silently. They are now
reported, named by the version Gradle attempted, and an unfetched jar
is marked so its component gets no targets.

Author: jfblaa

CHANGELOG.md

@@ -15,6 +15,8 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 - Maven dependencies with missing or invalid POMs are reported in every module that uses them, `system`-scope jars reach reachability analysis, and a failing dependency no longer fails scopes that `excludeConfigs` leaves out or the build when it lost a version conflict.
 - Reachability scans that hit unresolved JVM dependencies now point out that ignoring them also needs `--reach-continue-on-install-errors`.
 - A Gradle dependency whose variant is ambiguous in every configuration of its project now fails the run instead of quietly dropping out of the scan.
+- Gradle dependencies that fail dependency verification, or whose jars cannot be fetched, are reported instead of passed on as healthy.
+- Failed Gradle project dependencies are reported instead of silently dropping everything they pull in, and failures name the version that actually failed.
 
 ## [1.10.0](https://github.com/SocketDev/socket-cli/releases/tag/v1.10.0) - 2026-10-22
 

src/commands/manifest/scripts/resolution-report-gradle.mts

@@ -21,7 +21,11 @@ export function classifyGradleFailure(detail: string): FailureCategory {
   ) {
     return 'no-matching-variant'
   }
-  if (t.includes('cannot choose between')) {
+  // The artifact-level form: several transforms produce the requested variant.
+  if (
+    t.includes('cannot choose between') ||
+    t.includes('found multiple transformation chains')
+  ) {
     return 'variant-ambiguity'
   }
   if (

src/commands/manifest/scripts/resolution-report-render.test.mts

@@ -49,6 +49,21 @@ describe('resolution failure classification', () => {
     expect(r.nonBlockingNotice).toContain('ambiguous variant')
   })
 
+  it('classifies an ambiguous Gradle artifact transform as variant ambiguity', () => {
+    const r = renderResolutionErrorReport(
+      [
+        f(
+          'com.example:amb:1.0',
+          'Found multiple transformation chains that produce a variant of com.example:amb:1.0',
+        ),
+      ],
+      ['runtimeClasspath'],
+      'gradle',
+    )
+    expect(r.hasBlockingFailures).toBe(false)
+    expect(r.nonBlockingNotice).toContain('ambiguous variant')
+  })
+
   it("classifies Gradle's 'unable to find a matching variant' phrasing as blocking no-matching-variant", () => {
     const r = renderResolutionErrorReport(
       [

src/commands/manifest/scripts/socket-facts.init.gradle

@@ -6,3 +6,9 @@ project/.socket.facts.json
 project/.gradle/
 project/build/
 .populate-for.txt
+failures/localrepo/
+failures/records.tsv
+failures/.gradle/
+failures/build/
+failures/lib/build/
+failures/app/build/

src/commands/manifest/scripts/test/gradle-compat/.gitignore

@@ -0,0 +1,8 @@
+// Kept out of the root project: on some old Gradle, a project dependency on a missing configuration
+// fails resolving the declaring project's other configurations too.
+configurations {
+  projectFail
+}
+dependencies {
+  projectFail project(path: ':lib', configuration: 'nonexistent')
+}

src/commands/manifest/scripts/test/gradle-compat/failures/app/build.gradle

@@ -0,0 +1,57 @@
+// Hermetic fixture for ../smoke-test-failures.sh: each configuration fails to resolve in one way,
+// against a generated local Maven repo (see ../../make-stub-repo.sh).
+allprojects {
+  repositories {
+    maven { url rootProject.file('localrepo').toURI() }
+  }
+}
+
+configurations {
+  forced
+  shadowing
+  verified
+  walkAborted
+  quiet
+}
+configurations.forced.resolutionStrategy.force 'demo:c:9.9'
+
+dependencies {
+  forced 'demo:a:1.0'
+  // Shares the group:name of project :lib, but is an external module.
+  shadowing 'demo:lib:7.7'
+  verified 'demo:a:1.0'
+  verified 'demo:tampered:1.0'
+  walkAborted 'demo:a:1.0'
+  walkAborted 'demo:boom:1.0'
+  quiet 'demo:quiet:1.0'
+}
+
+// Artifact transforms and dependency verification exist only on newer Gradle.
+if (org.gradle.util.GradleVersion.current() >= org.gradle.util.GradleVersion.version('6.2')) {
+  apply from: 'transforms.gradle'
+}
+
+// No build throws from the walk's own reads on demand, so make two of them throw for one module
+// each: boom's children, and quiet's file with an empty message.
+tasks.matching { it.name == 'socketFactsCollect' }.all { t ->
+  t.doFirst {
+    def boom = configurations.walkAborted.resolvedConfiguration.firstLevelModuleDependencies.find { it.moduleName == 'boom' }
+    def depMeta = boom.getClass().metaClass
+    def children = depMeta.getMetaMethod('getChildren', [] as Object[])
+    depMeta.getChildren = { ->
+      if (delegate.moduleName == 'boom') {
+        throw new IllegalStateException('walk aborted by the fixture')
+      }
+      children.invoke(delegate)
+    }
+    def quiet = configurations.quiet.resolvedConfiguration.resolvedArtifacts.find { it.name == 'quiet' }
+    def artifactMeta = quiet.getClass().metaClass
+    def file = artifactMeta.getMetaMethod('getFile', [] as Object[])
+    artifactMeta.getFile = { ->
+      if (delegate.name == 'quiet') {
+        throw new RuntimeException('')
+      }
+      file.invoke(delegate)
+    }
+  }
+}

src/commands/manifest/scripts/test/gradle-compat/failures/build.gradle

@@ -0,0 +1,18 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!-- tampered's jar never matches its recorded checksum; every other artifact is trusted. -->
+<verification-metadata xmlns="https://schema.gradle.org/dependency-verification" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="https://schema.gradle.org/dependency-verification https://schema.gradle.org/dependency-verification/dependency-verification-1.0.xsd">
+  <configuration>
+    <verify-metadata>false</verify-metadata>
+    <verify-signatures>false</verify-signatures>
+    <trusted-artifacts>
+      <trust group="demo" name="^(?!tampered$).*$" regex="true"/>
+    </trusted-artifacts>
+  </configuration>
+  <components>
+    <component group="demo" name="tampered" version="1.0">
+      <artifact name="tampered-1.0.jar">
+        <sha256 value="0000000000000000000000000000000000000000000000000000000000000000"/>
+      </artifact>
+    </component>
+  </components>
+</verification-metadata>

src/commands/manifest/scripts/test/gradle-compat/failures/gradle/verification-metadata.xml

@@ -0,0 +1,3 @@
+apply plugin: 'java'
+group = 'demo'
+version = '3.0'

src/commands/manifest/scripts/test/gradle-compat/failures/lib/build.gradle

@@ -0,0 +1,2 @@
+rootProject.name = 'gradle-compat-failures'
+include 'lib', 'app'