[lelia]

Two flags documented behavior they don't have, and PR comment links were built from the same bare --repo value as if it were owner/repo.

Root Cause

--repo. The help text, metavar and docs/cli-reference.md all said owner/repo. The CLI sends the value as-is as the repository slug, which the API validates against ^[a-zA-Z0-9._-]+$, so any value with a / fails. Auto-detection (git remote, GITHUB_REPOSITORY) already produces the bare name, which hid the bug. Only an explicit --repo owner/repo, which is what the help text told people to pass, failed. In diff mode it fails at repository creation: before 2.11.10 that was a silent exit 2, and now it logs an HTTP 400.

--pending-head. The flag is parsed into config.pending_head and never read. set_as_pending_head follows is_default_branch, so the flag has no effect, and the docs said the two were "automatically synchronized".

Fix

• --repo:
  • The metavar is now <repo>, and the help text describes the slug without the owner and points to --workspace for the owner.
  • CliConfig.from_args exits 1 up front when --repo contains /, naming the slug to use (the last path segment, the same value auto-detection would produce).
  • This only rejects values that already failed at the API, so no working pipeline breaks.
• --pending-head:
  • Still accepted, as is the suppressed --pending_head alias, so existing pipelines don't hit an argparse error.
  • Hidden from --help, and it logs a deprecation warning pointing to --default-branch.
  • Not wired through, because the API only honors pending head on a tracked default branch, which --default-branch already covers.
• Docs (docs/cli-reference.md):
  • The --repo table row and the four --repo owner/repo examples now use a bare slug.
  • The GitLab CI example uses $CI_PROJECT_NAME. $CI_PROJECT_PATH is group/project and would now be rejected; before this change it failed at the API.
  • The Slack repos filter example used owner/repo, but the filter is matched against the bare config.repo, so the documented form never matched anything.
  • The --pending-head row, its usage-line entry and the "automatically synchronized" sentence are replaced with the deprecation note.
• Tests:
  • New TestRepoAndPendingHeadFlags tests in tests/unit/test_config.py; 6 of the 7 fail on main.
  • Three FOSSA tests passed owner/repo-style values as fixtures, and now use a bare slug. FOSSA mode creates a full scan the same way, so those values couldn't have worked against the API either.
• Version bumped to 2.11.12.

Manifest links in PR comments. core/messages.py built GitHub, GitLab and Bitbucket file links as {server}/{config.repo}/blob/.... config.repo is always the bare slug (with a suffix under --workspace-name), so every link pointed at github.com/<repo>/blob/... with no owner. The owner field in the ignore telemetry split config.repo on / and was always "".

• New resolve_repository_url() in core/pull_request.py returns the repository's web URL. It reads the CI environment first (GITHUB_REPOSITORY and GITHUB_SERVER_URL, CI_PROJECT_URL or CI_PROJECT_PATH, BITBUCKET_REPO_FULL_NAME), then the checkout's origin remote. It reuses the lookups the PR URL already does; _github_url and _gitlab_url now call the same helpers.
• main_code resolves it once into config.repository_url. Manifest links use it, and fall back to the Socket report link when it can't be resolved, instead of building a broken link.
• The telemetry owner is the URL path before the repository name: the owner on GitHub and Bitbucket, and the group path on GitLab.
• Credentials in an https://user:token@host/... remote are never used; only the host and path are kept.

Testing

• uv run pytest tests/unit tests/core: 753 passed. ruff check is clean and uv lock --locked is in sync.
• socketcli --api-token dummy --repo my-org/my-repo exits 1 with: --repo takes the repository slug without its owner, but got 'my-org/my-repo'. Use --repo my-repo, and --workspace for the owner if your repositories use one.
• socketcli --help shows --repo <repo> with the new text and no --pending-head.
• Against this checkout's origin, resolve_repository_url("github", ...) returns https://github.com/SocketDev/socket-python-cli, with owner SocketDev.

Fixes CE-490
Fixes CE-491
Refs CE-127

Public Changelog

--repo takes the repository slug (my-repo), not owner/repo. The CLI now explains this up front instead of failing at the API, and the docs examples are fixed. --pending-head is deprecated: it never had an effect, and it now logs a warning pointing to --default-branch. Manifest links in pull request comments now include the repository owner.

---

Note

Medium Risk
Changes CLI flag validation and PR comment URLs used in CI; pipelines that passed owner/repo to --repo will now exit 1 (previously failed at the API), while manifest links and telemetry owner fields behave differently when repository_url is resolved.

Overview
Release 2.11.12 aligns --repo with what the Socket API actually accepts and fixes broken SCM links in PR comments that were built from the bare repo slug.

--repo is now a Socket repository slug only (my-repo, not my-org/my-repo). Values containing / fail fast at exit code 1 with a suggested slug and a pointer to --workspace for the owner. Help, docs, and examples (including GitLab CI --repo $CI_PROJECT_NAME) are updated accordingly.

--pending-head is deprecated: still parsed for backward compatibility, hidden from --help, logs a warning, and remains a no-op—use --default-branch instead.

Manifest links in GitHub/GitLab/Bitbucket PR comments no longer use {server}/{config.repo}/blob/.... The CLI resolves config.repository_url from CI env vars or origin, builds correct blob/src URLs, and falls back to the Socket report when the owner cannot be determined. Ignore telemetry owner now comes from that URL path via repository_owner(), not from splitting --repo.

Unit tests cover the new validation, deprecation, URL resolution, and FOSSA fixtures now use bare slugs.

^{Reviewed by Cursor Bugbot for commit 800fde7. Configure here.}

[cursor]

Stale Bugbot comment from a previous run.

[lelia]

bugbot run

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 800fde7. Configure here.}