Report full-scan findings as repository findings, not new ones

A run with no baseline creates a full scan and suppresses blocking, because
there is nothing to compare against and so nothing can be attributed to the
change. When an alert-bearing output format is enabled the scan still carries
every finding in the repository, and the console summary labeled those `NEW`
and their link `Diff Url`.

Both are wrong for a full scan, and the first contradicts the exit code: the
summary reported blocking issues while the run exited 0, which reads as gating
that silently failed rather than gating that correctly did not apply.

Label the counts and the link by what the run produced, and say why the counts
do not gate. The alert list itself is left alone, since SARIF and JSON output
read it and renaming their fields would break consumers.

Author: lelia

socketsecurity/output.py

@@ -229,10 +229,8 @@ def save_sbom_file(self, diff_report: Diff, sbom_file_name: Optional[str] = None
 
     def build_summary_text(self, diff_report: Diff) -> str:
         """Render the console summary text for stdout and file output."""
-        if (
-            getattr(diff_report, "is_full_scan", False)
-            and not getattr(diff_report, "alerts_fetched", False)
-        ):
+        is_full_scan = getattr(diff_report, "is_full_scan", False)
+        if is_full_scan and not getattr(diff_report, "alerts_fetched", False):
             lines = ["Full scan completed. Findings were not fetched for console output."]
             report_link = getattr(diff_report, "report_url", "") or getattr(
                 diff_report, "diff_url", ""
@@ -264,20 +262,33 @@ def build_summary_text(self, diff_report: Diff) -> str:
         selected_diff = clone_diff_with_selected_alerts(diff_report, selected_alerts)
         console_security_comment = Messages.create_console_security_alert_table(selected_diff)
 
+        # A full scan has no baseline, so everything it carries is a finding in the
+        # repository rather than one the change introduced. Calling those NEW would
+        # also contradict the exit code, which stays 0 because no finding can be
+        # attributed to the change.
+        blocking_label = "Blocking issues" if is_full_scan else "NEW blocking issues"
+        warning_label = "Warning issues" if is_full_scan else "NEW warning issues"
+        link_label = "Report Url" if is_full_scan else "Diff Url"
+
         lines = ["Security issues detected by Socket Security:"]
         if new_blocking > 0:
-            lines.append(f"  - NEW blocking issues: {new_blocking}")
+            lines.append(f"  - {blocking_label}: {new_blocking}")
         if new_warning > 0:
-            lines.append(f"  - NEW warning issues: {new_warning}")
+            lines.append(f"  - {warning_label}: {new_warning}")
         if unchanged_blocking > 0:
             lines.append(
                 f"  - EXISTING blocking issues: {unchanged_blocking} (causing failure due to --strict-blocking)"
             )
         if unchanged_warning > 0:
             lines.append(f"  - EXISTING warning issues: {unchanged_warning}")
+        if is_full_scan:
+            lines.append(
+                "  Reported against the whole repository, with no baseline to compare "
+                "against, so these do not affect the exit code."
+            )
 
         report_link = getattr(diff_report, "report_url", "") or getattr(diff_report, "diff_url", "")
-        lines.append(f"Diff Url: {report_link}")
+        lines.append(f"{link_label}: {report_link}")
         lines.append("")
         lines.append(str(console_security_comment))
         return "\n".join(lines)

tests/unit/test_summary_text.py

@@ -0,0 +1,74 @@
+"""How the console summary distinguishes a comparison from a full scan.
+
+A full scan carries every finding in the repository, not the ones a change
+introduced, and blocking is suppressed for exactly that reason. The summary has
+to say so, or the reported counts read as gating failures that returned 0.
+"""
+from unittest.mock import MagicMock
+
+from socketsecurity.config import CliConfig
+from socketsecurity.core.classes import Diff, Issue
+from socketsecurity.output import OutputHandler
+
+
+def _issue(name: str, error: bool = False, warn: bool = False) -> Issue:
+    return Issue(
+        pkg_name=name,
+        pkg_version="1.0.0",
+        severity="high",
+        title=f"Vuln in {name}",
+        description="test",
+        type="vulnerability",
+        manifests="pom.xml",
+        pkg_type="maven",
+        key=f"key-{name}",
+        purl=f"pkg:maven/{name}@1.0.0",
+        url=f"https://socket.dev/maven/package/{name}/overview/1.0.0",
+        error=error,
+        warn=warn,
+    )
+
+
+def _handler() -> OutputHandler:
+    return OutputHandler(CliConfig.from_args(["--api-token", "test"]), MagicMock())
+
+
+def _diff(is_full_scan: bool) -> Diff:
+    diff = Diff()
+    diff.new_alerts = [_issue("alpha", error=True), _issue("beta", warn=True)]
+    diff.id = "scan-id"
+    diff.report_url = "https://socket.dev/dashboard/org/test/sbom/scan-id"
+    diff.diff_url = diff.report_url
+    diff.is_full_scan = is_full_scan
+    diff.alerts_fetched = is_full_scan
+    return diff
+
+
+def test_comparison_reports_findings_as_new():
+    summary = _handler().build_summary_text(_diff(is_full_scan=False))
+
+    assert "NEW blocking issues: 1" in summary
+    assert "NEW warning issues: 1" in summary
+    assert "Diff Url:" in summary
+
+
+def test_full_scan_does_not_report_findings_as_new():
+    summary = _handler().build_summary_text(_diff(is_full_scan=True))
+
+    assert "NEW" not in summary
+    assert "Blocking issues: 1" in summary
+    assert "Warning issues: 1" in summary
+
+
+def test_full_scan_labels_its_link_as_a_report():
+    summary = _handler().build_summary_text(_diff(is_full_scan=True))
+
+    assert "Report Url:" in summary
+    assert "Diff Url:" not in summary
+
+
+def test_full_scan_explains_why_the_counts_do_not_gate():
+    summary = _handler().build_summary_text(_diff(is_full_scan=True))
+
+    assert "no baseline to compare against" in summary
+    assert "do not affect the exit code" in summary