fix(scans): keep the package list on full scans

create_full_scan_with_report_url only fetched SBOM data when an alert-bearing
output format was enabled, so --generate-license and --legal-format fossa saw an
empty diff.packages and wrote an attribution file with zero packages. That is the
list they enumerate, as _requires_unchanged_artifacts already documents for the
comparison path.

Fetch the SBOM for them too, and enrich it through the PURL endpoint the way the
comparison path does. The full scan's package map is keyed by artifact id while
get_license_text_via_purl keys off ecosystem/name@version, so pass a purl-keyed
view over the same Package objects.

Alert consolidation stays behind its own gate, so an alert-only run does not pay
for the license lookup and a license-only run does not build an alert list.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: lelia

socketsecurity/core/__init__.py

@@ -1288,30 +1288,42 @@ def create_full_scan_with_report_url(
                 or self.cli_config.enable_sarif
             )
         )
+        # --generate-license (and --legal-format fossa, which it gates) enumerates
+        # diff.packages rather than the alert list, so a full scan has to carry the
+        # package map even when no alert-bearing output format is enabled. Without
+        # this, an SCM branch pipeline writes an attribution file with zero packages.
+        # Keep in sync with _requires_unchanged_artifacts, which lists the same
+        # consumers for the comparison path.
+        needs_license_artifacts = (
+            self.cli_config is not None and self.cli_config.generate_license
+        )
 
-        if needs_alerts:
-            log.info("Output format requires alerts, fetching SBOM data for full scan")
+        if needs_alerts or needs_license_artifacts:
+            log.info("Output format requires SBOM data, fetching it for the full scan")
             sbom_start = time.time()
             sbom_artifacts_dict = self.get_sbom_data(new_full_scan.id)
             sbom_artifacts = self.get_sbom_data_list(sbom_artifacts_dict)
             packages = self._create_packages_dict_without_license_text(sbom_artifacts)
+            if needs_license_artifacts:
+                packages = self._add_license_details(packages)
             diff.packages = packages
 
-            all_alerts_collection: Dict[str, List[Issue]] = {}
-            for package_id, package in packages.items():
-                self.add_package_alerts_to_collection(
-                    package=package,
-                    alerts_collection=all_alerts_collection,
-                    packages=packages
-                )
+            if needs_alerts:
+                all_alerts_collection: Dict[str, List[Issue]] = {}
+                for package_id, package in packages.items():
+                    self.add_package_alerts_to_collection(
+                        package=package,
+                        alerts_collection=all_alerts_collection,
+                        packages=packages
+                    )
 
-            consolidated: Set[str] = set()
-            for alert_key, alerts in all_alerts_collection.items():
-                for alert in alerts:
-                    alert_str = f"{alert.purl},{alert.type}"
-                    if (alert.error or alert.warn) and alert_str not in consolidated:
-                        diff.new_alerts.append(alert)
-                        consolidated.add(alert_str)
+                consolidated: Set[str] = set()
+                for alert_key, alerts in all_alerts_collection.items():
+                    for alert in alerts:
+                        alert_str = f"{alert.purl},{alert.type}"
+                        if (alert.error or alert.warn) and alert_str not in consolidated:
+                            diff.new_alerts.append(alert)
+                            consolidated.add(alert_str)
 
             sbom_end = time.time()
             log.info(
@@ -1323,6 +1335,24 @@ def create_full_scan_with_report_url(
 
         return diff
 
+    def _add_license_details(self, packages: dict[str, Package]) -> dict[str, Package]:
+        """Populate licenseAttrib/licenseDetails on a full scan's package map.
+
+        get_license_text_via_purl keys off ``ecosystem/name@version`` because that is
+        what the PURL endpoint echoes back, while a full scan's package map is keyed
+        by artifact id. Build a purl-keyed view over the same Package objects so the
+        enrichment lands on the map the caller keeps.
+        """
+        batch_size = self.cli_config.max_purl_batch_size if self.cli_config else 5000
+        self.get_license_text_via_purl(
+            {
+                f"{package.type}/{package.name}@{package.version}": package
+                for package in packages.values()
+            },
+            batch_size=batch_size,
+        )
+        return packages
+
     def get_full_scan(self, full_scan_id: str) -> FullScan:
         """
         Get a FullScan object for an existing full scan including sbom_artifacts and packages.

tests/core/test_full_scan_outputs.py

@@ -0,0 +1,87 @@
+"""What a full scan has to carry for each enabled output.
+
+create_full_scan_with_report_url runs on every path with no baseline to compare
+against: API mode, and (since 2.8.0) SCM branch pipelines. Fetching the SBOM is
+the expensive part, so it is gated on the enabled outputs -- these pin which
+outputs need it.
+"""
+import pytest
+from socketdev.fullscans import FullScanParams
+
+from socketsecurity.config import CliConfig
+from socketsecurity.core import Core
+from socketsecurity.core.socket_config import SocketConfig
+
+
+def _core(sdk, **cli_overrides):
+    config = CliConfig.from_args(["--api-token", "test"])
+    for key, value in cli_overrides.items():
+        setattr(config, key, value)
+    return Core(config=SocketConfig(api_key="test_key"), sdk=sdk, cli_config=config)
+
+
+@pytest.fixture
+def params():
+    return FullScanParams(org_slug="test-org", repo="test", branch="main")
+
+
+@pytest.fixture
+def sdk(mock_sdk_with_responses):
+    # get_license_text_via_purl iterates the response; the shared fixture leaves
+    # purl.post as a bare MagicMock.
+    mock_sdk_with_responses.purl.post.return_value = []
+    return mock_sdk_with_responses
+
+
+def test_license_generation_gets_the_package_list(sdk, params):
+    """--generate-license enumerates diff.packages, not diff.new_alerts.
+
+    Without this the attribution file for an SCM branch pipeline comes out empty.
+    """
+    core = _core(sdk, generate_license=True)
+
+    diff = core.create_full_scan_with_report_url(
+        ["."], params, explicit_files=["package.json"]
+    )
+
+    assert diff.packages
+    # No alert-bearing output format is enabled, so alerts stay unfetched.
+    assert diff.new_alerts == []
+
+
+def test_license_details_are_requested_for_the_scanned_packages(sdk, params):
+    core = _core(sdk, generate_license=True)
+
+    core.create_full_scan_with_report_url(
+        ["."], params, explicit_files=["package.json"]
+    )
+
+    components = sdk.purl.post.call_args.kwargs["components"]
+    # Keyed the way the PURL endpoint echoes results back, not by artifact id.
+    assert all(component["purl"].startswith("pkg:/") for component in components)
+    assert any("@" in component["purl"] for component in components)
+
+
+def test_alert_formats_still_fetch_the_sbom(sdk, params):
+    core = _core(sdk, enable_json=True)
+
+    diff = core.create_full_scan_with_report_url(
+        ["."], params, explicit_files=["package.json"]
+    )
+
+    assert diff.packages
+    # Alert-only outputs do not pay for the license lookup. (The scan fixture's
+    # alerts carry no action, so none of them consolidate into new_alerts.)
+    sdk.purl.post.assert_not_called()
+
+
+def test_console_only_run_skips_the_sbom_fetch(sdk, params):
+    core = _core(sdk)
+
+    diff = core.create_full_scan_with_report_url(
+        ["."], params, explicit_files=["package.json"]
+    )
+
+    assert diff.packages == {}
+    assert diff.new_alerts == []
+    sdk.fullscans.stream.assert_not_called()