fix(manifest): a crashed JVM build always fails, ignoring ignoreUnresolved

ignoreUnresolved (and --ignore-unresolved) means 'the build ran but some
dependencies could not be resolved; tolerate those'. It must not swallow the
build process itself failing (missing JDK/build tool, unparseable project, OOM,
plugin crash). Scope it to the blocking-resolution-failure branch only; a
crashed build now fails regardless.

Author: jfblaa

CHANGELOG.md

@@ -8,7 +8,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
 ### Changed
 - Quieter `socket manifest gradle`, `sbt`, and `maven`: the build tool's output is now hidden behind a progress spinner and shown only if the build fails. Pass `--verbose` to stream it live.
-- `--auto-manifest` now fails fast: if a Gradle, sbt, or Maven build can't be resolved, the run stops instead of continuing with an incomplete SBOM. Opt into tolerating install errors to keep going.
+- `--auto-manifest` now fails fast: if a Gradle, sbt, or Maven build fails, the run stops instead of continuing with an incomplete SBOM.
 
 ## [1.1.132](https://github.com/SocketDev/socket-cli/releases/tag/v1.1.132) - 2026-06-30
 

src/commands/manifest/run-manifest-facts.mts

@@ -26,9 +26,10 @@ function tailBuildOutput(stdout: string, stderr: string): string {
 
 // Runs the bundled build-tool resolution script for a JVM project and writes
 // `.socket.facts.json`. `withFiles` (reachability only) additionally folds
-// resolved artifact paths into `sidecarAcc`. A blocking resolution failure — or
-// a build that crashes without emitting any facts — sets a non-zero exit code
-// and returns (matching the `--pom` generator) unless `ignoreUnresolved`.
+// resolved artifact paths into `sidecarAcc`. A blocking resolution failure sets
+// a non-zero exit code and returns (matching the `--pom` generator) unless
+// `ignoreUnresolved`; a crashed build — a process failure, not an unresolved
+// dependency — always fails.
 export async function runManifestFacts({
   bin,
   buildOpts,
@@ -152,13 +153,14 @@ export async function runManifestFacts({
         logger.groupEnd()
       }
     }
-    const message = `The ${ecosystem} build failed (exit code ${code}) before producing any Socket facts.`
-    if (ignoreUnresolved) {
-      logger.warn(message)
-      return
-    }
+    // A crashed build is a process failure (missing JDK/build tool, unparseable
+    // project, OOM, plugin error), not an unresolved dependency, so it fails
+    // regardless of `ignoreUnresolved` — that flag only tolerates dependencies a
+    // successful run couldn't resolve.
     process.exitCode = 1
-    logger.fail(message)
+    logger.fail(
+      `The ${ecosystem} build failed (exit code ${code}) before producing any Socket facts.`,
+    )
     return
   }