Stop guessing the SCM host from the Socket diff URL

CHANGELOG.md

@@ -1,5 +1,13 @@
 # Changelog
 
+## 2.12.1
+
+### Changed
+
+- Manifest file links in PR comments and reports pick the source host only from
+  `--scm`. The fallback that guessed GitHub, GitLab, or Bitbucket from the Socket
+  diff URL never produced a link and has been removed.
+
 ## 2.12.0
 
 ### Added

pyproject.toml

@@ -6,7 +6,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "socketsecurity"
-version = "2.12.0"
+version = "2.12.1"
 requires-python = ">= 3.11"
 license = {"file" = "LICENSE"}
 dependencies = [

socketsecurity/__init__.py

@@ -1,4 +1,4 @@
 __author__ = 'socket.dev'
-__version__ = '2.12.0'
+__version__ = '2.12.1'
 USER_AGENT_NAME = 'socket-python-cli'
 USER_AGENT = f'{USER_AGENT_NAME}/{__version__}'

socketsecurity/core/messages.py

@@ -78,18 +78,10 @@ def get_manifest_file_url(diff: Diff, manifest_path: str, config=None) -> str:
         # Remove leading slashes
         clean_path = clean_path.lstrip('/')
 
-        # Determine SCM type from config or diff_url
-        scm_type = "api"  # Default to API
+        # diff.diff_url points at Socket, not the SCM, so only config decides.
+        scm_type = "api"
         if config and hasattr(config, 'scm'):
             scm_type = config.scm.lower()
-        elif hasattr(diff, 'diff_url') and diff.diff_url:
-            diff_url = diff.diff_url.lower()
-            if 'github.com' in diff_url or 'github' in diff_url:
-                scm_type = "github"
-            elif 'gitlab' in diff_url:
-                scm_type = "gitlab"
-            elif 'bitbucket' in diff_url:
-                scm_type = "bitbucket"
 
         # Generate URL based on SCM type using config information
         # NEVER use diff.diff_url for SCM URLs - those are Socket URLs for "View report" links

tests/unit/test_messages.py

@@ -102,3 +102,21 @@ def test_manifest_link_falls_back_to_the_report_without_a_repository_url():
     url = Messages.get_manifest_file_url(diff, "app/package.json", config)
 
     assert url == "https://socket.dev/report/123?tab=files&file=app%2Fpackage.json"
+
+
+
+def test_manifest_link_does_not_guess_the_scm_from_the_diff_url():
+    """Without an explicit scm, a GitHub-looking diff_url falls back to the report."""
+
+    class _NoScmConfig:
+        branch = "main"
+        repository_url = "https://github.com/acme/widgets"
+
+    diff = Diff(
+        diff_url="https://github.com/acme/widgets/pull/1",
+        report_url="https://socket.dev/report/123",
+    )
+
+    url = Messages.get_manifest_file_url(diff, "app/package.json", _NoScmConfig())
+
+    assert url == "https://socket.dev/report/123?tab=files&file=app%2Fpackage.json"