fix(scan): scope --reach-use-only-pregenerated-sboms to analysis input only

[Jeppe Fredsgaard Blaabjerg (jfblaa)]

Summary

• --reach-use-only-pregenerated-sboms was also filtering which manifest files get uploaded as part of the scan (restricting the upload to CDX/SPDX/Socket-facts files), in addition to controlling what Coana uses as input for reachability analysis.
• This wasn't the intent of the option: it should only control reachability analysis input. Removed the upload-side filtering (filterToPregeneratedSboms/getPregeneratedSbomPatterns in handle-create-new-scan.mts); the scan now always uploads all discovered package paths (minus a stray .socket.facts.json) regardless of this flag.
• The pass-through to Coana (--use-only-pregenerated-sboms in perform-reachability-analysis.mts) is unchanged.
• Updated the flag's help text to describe the corrected scope.

Test plan

• pnpm build:dist:src
• pnpm test:unit src/commands/scan/handle-create-new-scan.test.mts src/commands/scan/perform-reachability-analysis.test.mts (18 tests pass)
• npx eslint on both edited files (clean)

---

Note

Medium Risk
Changes what files are sent on full scans when --reach and --reach-use-only-pregenerated-sboms are used together—broader uploads than before, which can affect scan scope and results for users who relied on the old behavior.

Overview
--reach-use-only-pregenerated-sboms no longer limits which manifest files are uploaded with the scan. Uploads now always include all discovered package paths (still dropping a stray .socket.facts.json and appending Coana’s fresh reachability report), regardless of that flag.

The flag’s effect is limited to reachability analysis input (still passed through to Coana as --use-only-pregenerated-sboms). The upload-side filtering helpers (filterToPregeneratedSboms, getPregeneratedSbomPatterns, and the micromatch import) were removed from handle-create-new-scan.mts. Flag help text was updated to match.

Release 1.1.147 with a changelog entry.

^{Reviewed by Cursor Bugbot for commit a5ccebc. Configure here.}