fix(scan): surface GitHub rate-limit errors in bulk repo scan by jdalton · Pull Request #1235 · SocketDev/socket-cli

John-David Dalton (jdalton) · 2026-04-18T01:09:34Z

Summary

The bulk-scan loop in createScanFromGithub silently swallowed per-repo failures. A rate-limited GitHub token made every repo fail, yet the outer function returned ok:true with "N repos / 0 manifests", misleading users into thinking the scan worked.
Short-circuit the loop on known blocking errors (rate limit, GraphQL rate limit, abuse detection, auth failure) so subsequent repos don't burn more quota re-hitting the same wall.
Return an error CResult when every repo fails, so scripts can tell the run did not succeed.

Test plan

pnpm --filter @socketsecurity/cli run test:unit test/unit/commands/scan/create-scan-from-github.test.mts — 16 passed (3 new regression tests)
pnpm --filter @socketsecurity/cli run test:unit test/unit/commands/scan/ — 634 passed
pnpm run type — passes
pnpm run lint — passes

Note

Medium Risk
Changes bulk-scan control flow to short-circuit and return failures on rate-limit/auth conditions, which can alter CLI exit behavior and automation expectations.

Overview
Fixes createScanFromGithub bulk scanning to stop early and return ok:false when hitting blocking GitHub errors (rate limit, GraphQL rate limit, abuse detection, or auth failure) instead of continuing and reporting misleading "0 manifests" success.

Also treats the run as an error when all repos fail for non-blocking reasons, and updates the summary logging to report repos actually processed. Adds unit regression tests covering rate-limit short-circuiting, auth failure short-circuiting, and the "all repos failed" case (ASK-167).

^{Reviewed by Cursor Bugbot for commit 7f7f649. Configure here.}

The bulk-scan loop in `createScanFromGithub` silently swallowed per-repo failures. A rate-limited token made every repo fail, yet the outer function returned ok:true with "N repos / 0 manifests", misleading users into thinking the scan worked. - Track per-repo failures and short-circuit the loop on known blocking errors (rate limit, GraphQL rate limit, abuse detection, auth failure) so subsequent repos don't burn more quota for the same error - Return an error CResult when all repos fail, so scripts can tell the run did not succeed - Add regression tests covering the short-circuit and the all-repos-failed fallback

John-David Dalton (jdalton) · 2026-04-18T02:09:58Z

Cursor (@cursor) review

cursor

✅ Bugbot reviewed your changes and found no new issues!