Raise on SBOM fetch failure and require socketdev 3.4.2

[lelia]

Summary

When the full-scan SBOM stream fetch failed, Core.get_sbom_data logged at debug level and returned {}, so report generation continued and produced empty GitLab dependency-scanning, license, and SARIF output with exit code 0. The most common trigger was SocketDev/socket-sdk-python#101: a single artifact with a purl type the SDK didn't recognize (e.g. generic) failed the whole stream parse.

Changes

• Core.get_sbom_data now logs at error level and raises APIFailure when the stream fetch fails, so the run goes through the existing API-error handling (exit code 3 by default; --disable-blocking still exits 0) instead of emitting empty reports
• Bump socketdev floor to 3.4.2, the bundled release containing the missing purl types and per-artifact parse resilience

SDK rollout

• Publish socketdev 3.4.2 after fix(purl): expose fail-open batch params and harden dedupe socket-sdk-python#98 lands; that release bundles SDK PRs Bump requests from 2.32.3 to 2.32.4 #98, Fix exit code from returning 5 on diff reports with no error alerts a… #99, and Refactor file detection and scanning logic to fix commit file handling #101.
• Regenerate uv.lock against PyPI after 3.4.2 is available, then merge this PR.

Testing

• New regression test test_get_sbom_data_failure_raises
• pytest tests/unit tests/core against socketdev built from Add missing purl types and per-artifact parse resilience to full-scan stream socket-sdk-python#101: 421 passed, 2 skipped (pre-existing)

Draft until socketdev 3.4.2 is published to PyPI (same gating as #284).

Remaining steps once 3.4.2 is on PyPI:

• uv lock --upgrade-package socketdev and commit — uv.lock still pins 3.3.0 and can't be regenerated until the release exists, and the dependency-review jobs run uv sync --locked
• Re-run CI and mark ready for review

Ref: CE-362

---

Note

Medium Risk
Changes error handling on a core SBOM fetch path used for reports and full-scan loading; behavior is intentional but affects all consumers of get_sbom_data on stream parse/API failures.

Overview
Fixes CE-362: when the full-scan SBOM stream fetch fails, CI no longer finishes with exit 0 and empty GitLab, license, and SARIF output.

Core.get_sbom_data now logs at error and raises APIFailure when fullscans.stream returns success: false, so the run uses existing API-error handling (exit code 3 by default; --disable-blocking still exits 0) instead of treating the failure as an empty SBOM.

The socketdev floor moves from 3.4.2 (from 3.3.0) to pick up stream parsing fixes (e.g. unrecognized purl types like generic and per-artifact resilience).

A regression test test_get_sbom_data_failure_raises asserts the raise behavior.

^{Reviewed by Cursor Bugbot for commit 77b18a7. Configure here.}

[github-actions]

❌ Version Check Failed

Please increment...

[lelia]

bugbot run

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 77b18a7. Configure here.}