Add beta Bazel JVM manifest support

[Simon (simonhj)]

Summary

Adds beta Bazel JVM SBOM support to Socket CLI.

Bazel is multi-language, but this PR starts with Bazel + Maven because many Bazel JVM repos declare Maven dependencies through rules_jvm_external in MODULE.bazel or WORKSPACE instead of committing a manifest Socket can already scan. The extractor asks Bazel what Maven artifacts it resolved, converts that into a maven_install.json-shaped manifest, and sends it through the existing scan pipeline.

What changed

• Adds socket manifest bazel [beta], a generation-only command for producing Bazel JVM SBOM manifests.
• Extends socket scan create --auto-manifest so Bazel workspaces are detected automatically and scanned through the normal scan-create flow.
• Detects Bazel workspaces via MODULE.bazel, WORKSPACE, or WORKSPACE.bazel.
• Supports Bzlmod and legacy WORKSPACE invocation modes.
• Discovers Maven repos from Bazel-visible repos / workspace metadata, including custom repo names beyond @maven.
• Parses jvm_import and aar_import rules from bazel query --output=build.
• Uses unsorted_deps.json when available as a faster structured source.
• Writes auto-manifest output under .socket-auto-manifest/maven_install.json so we do not overwrite a repo's checked-in maven_install.json.
• Adds docs, changelog entry, socket.json defaults, fixtures, and test coverage.

User flow

Generate only:

socket manifest bazel .

Generate and upload in one step:

socket scan create --auto-manifest .

Testing

Tested with unit and integration coverage for:

• Bazel binary resolution.
• Bzlmod vs legacy WORKSPACE detection.
• Bazel query argv construction.
• Maven repo discovery, including custom repo names and multi-repo cases.
• jvm_import / aar_import parsing.
• unsorted_deps.json parsing.
• Normalization into maven_install.json.
• Auto-manifest dispatch and .socket-auto-manifest/ output behavior.

Also tested against a corpus of Bazel repositories covering constructed and real-world Maven extraction cases, Bzlmod, legacy WORKSPACE, custom repo names, pinned and unpinned lockfile flows, and scan-create auto-manifest behavior.

Local checks:

git diff --check origin/v1.x
pnpm check:tsc
pnpm exec eslint --report-unused-disable-directives eslint.config.js src/commands/fix/coana-fix.mts src/commands/manifest src/commands/scan/handle-create-new-scan.mts src/commands/scan/handle-create-new-scan.test.mts src/utils/socket-json.mts vitest.config.mts
pnpm exec vitest run src/commands/manifest/bazel/bazel-bin-detect.test.mts src/commands/manifest/bazel/bazel-build-parser.test.mts src/commands/manifest/bazel/bazel-java-shim.test.mts src/commands/manifest/bazel/bazel-output-base-check.test.mts src/commands/manifest/bazel/bazel-python-shim.test.mts src/commands/manifest/bazel/bazel-query-runner.test.mts src/commands/manifest/bazel/bazel-repo-discovery.test.mts src/commands/manifest/bazel/bazel-workspace-detect.test.mts src/commands/manifest/bazel/cmd-manifest-bazel.test.mts src/commands/manifest/bazel/extract_bazel_to_maven.test.mts src/commands/manifest/bazel/generate_auto_manifest.bazel.constructed.test.mts src/commands/manifest/detect-manifest-actions.test.mts src/commands/manifest/generate_auto_manifest.test.mts src/commands/manifest/cmd-manifest.test.mts src/commands/scan/handle-create-new-scan.test.mts

---

Note

Medium Risk
Adds a new Bazel-based manifest generation pipeline that shells out to bazel/bazelisk, reads workspace outputs, and feeds generated files into scan create target discovery; failures or environment differences (Java/Python/Bazel setup, permissions, timeouts) could impact scan creation behavior.

Overview
Adds beta Bazel JVM SBOM support via a new socket manifest bazel subcommand that discovers rules_jvm_external Maven repos (Bzlmod and legacy WORKSPACE), runs Bazel queries / reads unsorted_deps.json, and normalizes the results into a maven_install.json-shaped manifest.

Extends socket scan create --auto-manifest to detect Bazel workspaces (MODULE.bazel, WORKSPACE, WORKSPACE.bazel), generate the Bazel manifest into a sidecar directory, and include those generated files in subsequent scan file discovery.

Introduces Bazel-specific hardening and plumbing (bazel binary resolution, Java/Python prerequisites, --output_base validation, bounded parsers/DoS guards), plus new socket.json defaults, docs/changelog updates, fixtures, and broad unit/integration test coverage.

^{Reviewed by Cursor Bugbot for commit 28ad5cb. Configure here.}

[Martin Torp (mtorp)]

Looks good 👏

[cursor]

Cursor Bugbot has reviewed your changes and found 4 potential issues.

^{Bugbot Autofix is ON. A cloud agent has been kicked off to fix the reported issues.}

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 28ad5cb. Configure here.}