feat(gitlab): fall back to the nearest scanned ancestor for --base-commit-sha

A merge base can have no full scan even when default-branch scanning is
configured and running: squash merges and rebases rewrite commits, and a
multi-commit push produces one scan for the tip while leaving the commits in
between unscanned. Any of those turned every open merge request into a failed
pipeline, because a missing baseline was a hard stop with no degraded mode.

The requested commit is still preferred. When it has no scan, one listing of
recent scans is matched against local first-parent history and the nearest
scanned ancestor is used instead, logged at warning with the commit chosen and
its distance. Only an unreachable ancestor now fails the run.

Both bounds are fixed and neither costs an extra request: the listing is fetched
once, and the walk stops at a set depth. Following first parents keeps a merge
commit from contributing everything merged into it, and a shallow checkout
simply narrows the search rather than breaking it.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: lelia

CHANGELOG.md

@@ -16,6 +16,11 @@
   introducing chain is unavailable, instead of reporting the location as
   `unknown`, and report whether a dependency is direct from the package record
   rather than inferring it from a dependency-path string that is never produced.
+- `--base-commit-sha` degrades to the nearest scanned ancestor of the requested
+  commit instead of failing the run, and logs which commit was used and how far
+  back it is. Squash merges, rebases, and multi-commit pushes all leave a merge
+  base unscanned even when default-branch scanning is configured correctly. The
+  run still fails when no scanned ancestor is reachable.
 - Implicit diff baselines are selected from the same workspace, scan type,
   repository, and default branch. A baseline lookup that fails is reported as an
   API error instead of resolving to an empty baseline, and temporary scans are

socketsecurity/core/__init__.py

@@ -18,6 +18,7 @@
 
 if TYPE_CHECKING:
     from socketsecurity.config import CliConfig
+from git import Repo
 from socketdev import socketdev
 from socketdev.exceptions import APIFailure
 from socketdev.fullscans import DiffArtifacts, FullScanParams, SocketArtifact
@@ -56,6 +57,12 @@
 # Core.newest_persisted_scan_id), so a single result is not enough.
 SCAN_LOOKUP_PAGE_SIZE = 10
 
+# Bounds on the search for a scanned ancestor when the requested baseline commit has
+# no full scan of its own. The scan listing is fetched once and matched against local
+# history, so neither bound costs an extra request.
+ANCESTOR_SCAN_LOOKUP_LIMIT = 100
+ANCESTOR_WALK_MAX_DEPTH = 100
+
 # Reachability facts-file upload compression.
 #
 # The Socket full-scan endpoint transparently brotli-decompresses any multipart part
@@ -1555,6 +1562,102 @@ def newest_persisted_scan_id(results: List[dict]) -> Optional[str]:
                 return scan_id
         return None
 
+    def first_parent_commits(self, start_commit_sha: str, max_count: int) -> List[str]:
+        """
+        Lists a commit and its first-parent ancestors, newest first.
+
+        Follows only first parents so a merge commit contributes the branch's own
+        history rather than everything merged into it. A shallow checkout simply
+        yields fewer commits, which narrows the search rather than failing it.
+
+        Args:
+            start_commit_sha: Commit to walk back from, included in the result
+            max_count: Maximum number of commits to return
+
+        Returns:
+            Commit SHAs, newest first. Empty when the repository or commit is
+            unavailable locally.
+        """
+        target_path = self.cli_config.target_path if self.cli_config else None
+        if not target_path:
+            return []
+        try:
+            repo = Repo(target_path)
+            output = repo.git.rev_list(
+                "--first-parent",
+                f"--max-count={max_count}",
+                start_commit_sha,
+            )
+        except Exception as error:
+            log.debug(f"Unable to walk history back from {start_commit_sha}: {error}")
+            return []
+        return [line.strip() for line in output.splitlines() if line.strip()]
+
+    def find_baseline_scan_for_ancestor(
+            self,
+            repo_slug: str,
+            commit_sha: str,
+            workspace: Optional[str] = None,
+            scan_type: Optional[str] = None,
+    ) -> Tuple[Optional[str], Optional[str], int]:
+        """
+        Finds the nearest ancestor of a commit that does have a full scan.
+
+        Used when --base-commit-sha names a commit that was never scanned. Squash
+        merges and rebases rewrite commits, and a multi-commit push produces one scan
+        for the tip, so a merge base can be unscanned even when default-branch
+        scanning is configured correctly. Diffing against a slightly older ancestor
+        is a wider diff; failing outright is no diff at all.
+
+        One scan listing is fetched and matched against local first-parent history,
+        so the walk costs no additional requests.
+
+        Args:
+            repo_slug: Repository slug the scan belongs to
+            commit_sha: Commit that has no full scan of its own
+            workspace: Socket workspace the scan belongs to, if any
+            scan_type: Socket scan type to match, if any
+
+        Returns:
+            (scan_id, ancestor_commit_sha, commits_back), or (None, None, 0) when no
+            scanned ancestor is reachable.
+        """
+        query_params = {
+            "repo": repo_slug,
+            "sort": "created_at",
+            "direction": "desc",
+            "per_page": ANCESTOR_SCAN_LOOKUP_LIMIT,
+        }
+        if workspace:
+            query_params["workspace"] = workspace
+        if scan_type:
+            query_params["scan_type"] = Core.query_param_value(scan_type)
+
+        response = self.sdk.fullscans.get(self.config.org_slug, query_params)
+        results = response.get("results") if isinstance(response, dict) else None
+        if not results:
+            return None, None, 0
+
+        scans_by_commit = {}
+        for result in results:
+            if not isinstance(result, dict) or result.get("tmp"):
+                continue
+            result_commit = result.get("commit_hash")
+            scan_id = result.get("id")
+            # Newest first, so the first scan seen for a commit is the one to keep.
+            if result_commit and scan_id and result_commit not in scans_by_commit:
+                scans_by_commit[result_commit] = scan_id
+
+        if not scans_by_commit:
+            return None, None, 0
+
+        ancestors = self.first_parent_commits(commit_sha, ANCESTOR_WALK_MAX_DEPTH)
+        for distance, ancestor in enumerate(ancestors):
+            scan_id = scans_by_commit.get(ancestor)
+            if scan_id:
+                return scan_id, ancestor, distance
+        return None, None, 0
+
     def get_full_scan_id_by_commit(
             self,
             repo_slug: str,
@@ -1628,19 +1731,38 @@ def resolve_base_full_scan_id(self, params: FullScanParams) -> Optional[str]:
                 workspace=params.workspace,
                 scan_type=params.scan_type,
             )
+            baseline_source = "explicit-commit"
+            baseline_commit = commit_sha
             if scan_id is None:
-                log.error(
-                    f"No full scan found for commit {commit_sha} in repo {params.repo} "
-                    "(--base-commit-sha). Ensure a scan was created for that commit "
-                    "(e.g. the CLI runs on default-branch pushes), or pass "
-                    "--base-scan-id instead."
+                scan_id, ancestor_sha, commits_back = self.find_baseline_scan_for_ancestor(
+                    params.repo,
+                    commit_sha,
+                    workspace=params.workspace,
+                    scan_type=params.scan_type,
                 )
-                if self.cli_config.disable_blocking:
-                    sys.exit(0)
-                sys.exit(self.cli_config.exit_code_on_api_error)
+                if scan_id:
+                    baseline_source = "explicit-commit-ancestor"
+                    baseline_commit = ancestor_sha
+                    log.warning(
+                        f"No full scan for commit {commit_sha} (--base-commit-sha). "
+                        f"Diffing against its nearest scanned ancestor {ancestor_sha}, "
+                        f"{commits_back} commit(s) earlier, so the diff is wider than "
+                        "the merge base."
+                    )
+                else:
+                    log.error(
+                        f"No full scan found for commit {commit_sha} in repo {params.repo} "
+                        "(--base-commit-sha), and no scanned ancestor within "
+                        f"{ANCESTOR_WALK_MAX_DEPTH} commits of it. Ensure a scan was "
+                        "created for that commit (e.g. the CLI runs on default-branch "
+                        "pushes), or pass --base-scan-id instead."
+                    )
+                    if self.cli_config.disable_blocking:
+                        sys.exit(0)
+                    sys.exit(self.cli_config.exit_code_on_api_error)
             log.info(
-                "Baseline selected: source=explicit-commit "
-                f"scan_id={json.dumps(scan_id)} commit={json.dumps(commit_sha)}"
+                f"Baseline selected: source={baseline_source} "
+                f"scan_id={json.dumps(scan_id)} commit={json.dumps(baseline_commit)}"
             )
             return scan_id
 

tests/core/test_sdk_methods.py

@@ -304,6 +304,54 @@ def test_resolve_base_full_scan_id_uses_base_commit_sha(core):
         },
     )
 
+def test_resolve_base_full_scan_id_falls_back_to_scanned_ancestor(core, monkeypatch):
+    """An unscanned merge base degrades to the nearest scanned ancestor"""
+    core.cli_config = make_cli_config("--base-commit-sha", "unscanned-sha")
+    core.sdk.fullscans.get.side_effect = [
+        {"results": [], "nextPage": None},                                  # exact commit
+        {"results": [                                                       # recent scans
+            {"id": "tmp-scan", "commit_hash": "ancestor-1", "tmp": True},
+            {"id": "ancestor-scan", "commit_hash": "ancestor-2"},
+        ], "nextPage": None},
+    ]
+    monkeypatch.setattr(
+        Core, "first_parent_commits",
+        lambda self, sha, depth: ["unscanned-sha", "ancestor-1", "ancestor-2"],
+    )
+
+    params = make_full_scan_params()
+    assert core.resolve_base_full_scan_id(params) == "ancestor-scan"
+
+
+def test_resolve_base_full_scan_id_ancestor_fallback_skips_temporary_scans(core, monkeypatch):
+    """A tmp scan on an ancestor is not a usable baseline either"""
+    core.cli_config = make_cli_config("--base-commit-sha", "unscanned-sha")
+    core.sdk.fullscans.get.side_effect = [
+        {"results": [], "nextPage": None},
+        {"results": [{"id": "tmp-scan", "commit_hash": "ancestor-1", "tmp": True}], "nextPage": None},
+    ]
+    monkeypatch.setattr(
+        Core, "first_parent_commits",
+        lambda self, sha, depth: ["unscanned-sha", "ancestor-1"],
+    )
+
+    with pytest.raises(SystemExit):
+        core.resolve_base_full_scan_id(make_full_scan_params())
+
+
+def test_resolve_base_full_scan_id_ancestor_fallback_needs_local_history(core, monkeypatch):
+    """Without local history there is nothing to match scans against"""
+    core.cli_config = make_cli_config("--base-commit-sha", "unscanned-sha")
+    core.sdk.fullscans.get.side_effect = [
+        {"results": [], "nextPage": None},
+        {"results": [{"id": "ancestor-scan", "commit_hash": "ancestor-2"}], "nextPage": None},
+    ]
+    monkeypatch.setattr(Core, "first_parent_commits", lambda self, sha, depth: [])
+
+    with pytest.raises(SystemExit):
+        core.resolve_base_full_scan_id(make_full_scan_params())
+
+
 def test_resolve_base_full_scan_id_commit_sha_not_found_exits(core):
     """A --base-commit-sha with no scan is a hard error (exit_code_on_api_error)"""
     core.cli_config = make_cli_config("--base-commit-sha", "abc123")