Fix GitLab report links, identifiers and locations, and make diff baselines resilient

[lelia]

Summary

Package links

• Normalize package identities and links when the SDK returns enum-backed ecosystem types and namespaced packages
• Separate namespace from name, so Maven links no longer fuse groupId and artifactId into one unresolvable path segment
• Warn when a namespaced ecosystem yields a package with no namespace, instead of emitting a broken link silently

Report contents

• Emit CVE and GHSA identifiers from the current API payload fields, and from the older spellings that still appear
• Omit an absent identifier url instead of sending null, which fails schema validation for the whole finding
• Record the manifest a finding came from when the introducing chain is unavailable, instead of reporting the location as unknown
• Report whether a dependency is direct from the package record, rather than inferring it from a dependency-path string no producer emits

Diff baselines

• --base-commit-sha uses the exact matching scan when available and otherwise falls back to the nearest scanned first-parent ancestor, logging which commit was used and how far back it is
• Paginate matching scan history so reruns and other branches cannot hide a reachable scanned ancestor beyond the first 100 recent scans
• Resolve implicit baselines from the same workspace, scan type, repository, and default branch, including when no workspace is supplied
• Treat failed head and exact-commit lookups as API errors rather than resolving to an empty baseline or falling back to an older ancestor
• Skip temporary scans when selecting a baseline across all three lookups
• Update CLI help and CI/CD documentation to describe the ancestor fallback, local-history limit, failure behavior, and optional exact-baseline backfill

Version bumped to 2.8.2.

Why these belong together

These all sit at the boundary between Socket API data and GitLab-facing output, and they share the same two failure modes: a malformed value reaching the report, or a missing baseline silently becoming an empty one. They also ship in one release, so splitting them would add review cycles without changing what lands.

Testing

• pytest -q tests/unit tests/core — 568 passed, 2 skipped. A bare pytest honors testpaths = tests/unit and skips tests/core; CI runs both directories explicitly.
• ruff check socketsecurity tests — clean across the full tree.
• git diff --check — clean.
• Report output validated against GitLab's published dependency-scanning-report-format.json (v15.2.5): zero errors, including the previously invalid null-url case.
• Baseline coverage includes scan-type scoping without a workspace, paginated ancestor selection, exact-lookup API failures, temporary scans, missing local history, and missing ancestors.

Notes for review

• The package-link separator is a slash for every ecosystem, matching socket.dev's own package URLs. Purl strings keep the slash form the purl spec defines.
• location.file is required with minLength: 1 in the GitLab schema, so unknown stays as a last-resort placeholder rather than being omitted.
• Directness previously read as true for every finding, transitive included, because the inference looked for a " > " separator get_source_data never produces. Two tests encoded that inference and now use the package record.
• Ancestor fallback is only entered after a successful exact-commit lookup returns no persisted scan. API failures remain infrastructure errors, because selecting an older or empty baseline would misreport what the PR introduced.

---

Fixes: CE-435, CE-438, CE-453
Refs: CE-441

[lelia]

bugbot run

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit c5fcbc8. Configure here.}