Feat/cseng 173 allow incomplete SBOM

[neema-beglou-snyk]

Pull Request Submission Checklist

• Follows CONTRIBUTING guidelines
• Commit messages
  are release-note ready, emphasizing
  what was changed, not how.
• Includes detailed description of changes
• Contains risk assessment (Low | Medium | High)
• Highlights breaking API changes (if applicable)
• Links to automated tests covering new functionality
• Includes manual testing instructions (if necessary)
• Updates relevant GitBook documentation (PR link: ___)
• Includes product update to be announced in the next stable release notes

What does this PR do?

When --print-effective-graph-with-errors is set, the legacy CLI can fail on individual projects during a multi-project scan. These changes catch those project failures and return them as failedResults instead of throwing, so downstream consumers can include them to annotate sboms. Changes made to both the single and multi plugin route and is robust against full and partial failure of manifest file/'s.

Where should the reviewer start?

get-deps-from-plugin.ts --> Wrap the plugin around a try/catch to ensure we always return something.
get-multi-plugin-result.ts --> We make sure to return failedResults to later parse into scanError.

What's the product update that needs to be communicated to CLI users?

Any background context you want to provide?

This is for the JPMC "fail-fast initative" --> the idea is to annotate sbom's with failures rather than print to stdout.

[github-actions]

	Fails
🚫	"Feat/cseng 173 allow incomplete SBOM" is not using a valid commit message format. For commit guidelines, see: CONTRIBUTING.

	Warnings
⚠️	Since the CLI is unifying on a standard and improved tooling, we're starting to migrate old-style imports and exports to ES6 ones. A file you've modified is using either module.exports or require(). If you can, please update them to ES6 import syntax and export syntax. Files found: src/lib/plugins/get-multi-plugin-result.ts
⚠️	You've modified files in src/ directory, but haven't updated anything in test folder. Is there something that could be tested?
⚠️	There are multiple commits on your branch, please squash them locally before merging!
⚠️	"[feat: support single plugin legacy path by returning errors rather than throwing CSENG-173](https://api.github.com/repos/snyk/cli/git/commits/8375506eda2d06bcb0346b4b7fb22be87dd09f87)" is too long. Keep the first line of your commit message under 72 characters.
⚠️	"[feat: Added a gate for returning errors when all projects fail CSENG-173](https://api.github.com/repos/snyk/cli/git/commits/6a9f264d443d845e114f2b3f17b17ccd00e77041)" is too long. Keep the first line of your commit message under 72 characters.

Generated by 🚫 dangerJS against 8375506

[snyk-pr-review-bot]

PR Reviewer Guide 🔍

🧪 No relevant tests

🔒 No security concerns identified

⚡ Recommended focus areas for review Inconsistent fail-fast logic 🟠 [major] The check !options['fail-fast'] at line 188 prevents the CLI from returning the failedResults structure when every project in a multi-project scan fails. Instead, it falls through to throw a terminal error. This is inconsistent with the single-project path in get-deps-from-plugin.ts (line 114), which returns the failed result regardless of fail-fast. This prevents the generation of an 'incomplete SBOM' (the PR's stated goal) for users in multi-project environments where fail-fast might be a default or configured setting. if (options['print-effective-graph-with-errors'] && !options['fail-fast']) { Potential TypeError 🟡 [minor] In the catch block, the code accesses error.message. If the caught error is not an object (e.g., a string or undefined thrown by a plugin), this will cause a TypeError, crashing the process instead of returning the failed results. The same issue exists in get-multi-plugin-result.ts at line 170. Using optional chaining (error?.message) would make this robust catch-all safer. const errMessage = error.message ?? 'Something went wrong getting dependencies';

📚 Repository Context Analyzed This review considered 7 relevant code sections from 7 files (average relevance: 1.04) src/lib/plugins/get-deps-from-plugin.ts (lines 1-187) src/lib/plugins/get-multi-plugin-result.ts (lines 1-294) src/cli/commands/log4shell.ts (lines 1-313) packages/snyk-fix/src/plugins/python/index.ts (lines 1-94) packages/snyk-fix/src/index.ts (lines 1-136) packages/snyk-fix/src/plugins/python/handlers/pip-requirements/index.ts (lines 1-308) src/cli/commands/fix/index.ts (lines 1-203)

[snyk-io]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues
✅	Code Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.