fix: preserve directory-only manifest patterns

Address peer review feedback by retaining pathlib.rglob trailing-slash semantics, trimming the release notes, and removing redundant implementation commentary.

Author: lelia

CHANGELOG.md

@@ -4,44 +4,22 @@
 
 ### Changed: faster local scan setup for large repositories
 
-- Replaced repeated per-pattern recursive manifest globs with one streaming
-  filesystem walk per scan root. Excluded directories and `.git` are pruned
-  before descent, reducing filesystem metadata work without building a
-  repository-sized in-memory file index.
-- Removed the unconditional `git fetch --all` from CLI initialization. Pull
-  request scans now use local refs first and fetch only a required base or head
-  ref when the checkout does not contain enough history.
-- Added native Buildkite commit, branch, pull-request range, and GitHub SCM
-  configuration fallbacks so Buildkite jobs no longer need GitHub
-  Actions-shaped environment-variable shims.
-- Added INFO-level timings for CLI run registration, organization setup, Git
-  initialization and fetches, changed-file detection, supported-pattern lookup,
-  and manifest discovery.
-- Supported manifest patterns are cached for each CLI invocation once the API
-  returns them, so a transient lookup failure no longer keeps the run on the
-  smaller local fallback pattern set. Manifest results from `--sub-path` routing
-  are reused during scan creation.
+- Manifest discovery now uses one filesystem walk per scan root and prunes
+  excluded directories before descent.
+- Pull request scans use local Git refs first and fetch only missing history.
+  Buildkite pull request metadata is now supported directly.
+- Supported manifest patterns are cached per invocation, and discovered
+  manifests are reused during scan creation.
+- Added timings for initialization, Git operations, changed-file detection,
+  pattern lookup, and manifest discovery.
 
 ### Changed: scan comparisons no longer fetch unused artifacts
 
-- Scan comparisons now ask the API to omit unchanged artifacts unless an enabled
-  output actually reads them (`--strict-blocking`, `--enable-gitlab-security`,
-  `--generate-license`, or `--legal-format fossa`). Cached comparison responses
-  embed every unchanged artifact at roughly 1 KB each, so on a large dependency
-  tree this was most of the response — over 10 MB for a tree of ~10k unchanged
-  packages — downloaded and parsed on every pull request even when nothing read
-  it. Behavior is unchanged for any run that uses those outputs.
-
-### Changed: scan comparison timing is easier to attribute
-
-- Lowered the diff-scan poll ceiling from 30s to 10s. A finished comparison is no
-  longer left unobserved for up to half a minute, which matters when the CLI runs
-  inside a CI step with a per-step time budget.
-- Diff scans now log their ID, poll count, and the wait before the final poll, so
-  a CI log distinguishes backend comparison time from time spent between polls.
+- Scan comparisons omit unchanged artifacts unless an enabled output needs them.
+- Diff scans poll more frequently and log identifiers and timing details for
+  easier troubleshooting.
 - Documented the `diff-scans:create`, `diff-scans:list` and `full-scans:list`
-  token scopes. Without them the comparison silently falls back to the older
-  streaming path.
+  token scopes required by the optimized comparison path.
 
 ## 2.6.5
 

socketsecurity/core/__init__.py

@@ -103,13 +103,6 @@
 # minutes to compute. The timeout is a backstop against a diff scan that never
 # completes; on expiry (or any other failure of this flow) the caller falls back to the
 # legacy streaming comparison rather than failing the scan outright.
-#
-# The max interval is also the upper bound on how long a finished comparison sits
-# unnoticed between polls, which is dead time added to every PR job. Callers commonly
-# run this inside a CI step with a per-step time budget of a few minutes, so the cap is
-# kept small: a multi-minute comparison costs roughly 2x the polls of a 30s cap while
-# cutting the worst-case dead time from 30s to 10s. Diff scans log their poll count and
-# last interval on completion so this tradeoff can be re-evaluated against real timings.
 DIFF_SCAN_POLL_INITIAL_INTERVAL_SECONDS = 5.0
 DIFF_SCAN_POLL_MAX_INTERVAL_SECONDS = 10.0
 DIFF_SCAN_POLL_BACKOFF_MULTIPLIER = 1.5
@@ -495,12 +488,12 @@ def _prepare_manifest_patterns(
         # PurePath.match compares pattern segments right to left, so a path-shaped glob
         # can only match a file whose basename matches the glob's final segment. Folding
         # those final segments into the basename prefilter lets the walk skip the path
-        # match for everything else. An empty final segment (a trailing "/") constrains
-        # nothing, so it becomes "*" and the prefilter admits every name.
+        # match for everything else. A trailing "/" is directory-only under the legacy
+        # rglob behavior, so its empty final segment intentionally admits no files.
         candidate_basenames = set(literal_basenames)
         candidate_basename_globs = set(basename_globs)
         for pattern in path_globs:
-            final_segment = pattern.rstrip("/").rsplit("/", 1)[-1] or "*"
+            final_segment = pattern.rsplit("/", 1)[-1]
             if any(character in final_segment for character in "*?["):
                 candidate_basename_globs.add(final_segment)
             else:

tests/unit/test_manifest_discovery.py

@@ -117,6 +117,24 @@ def test_single_walk_matches_legacy_rglob_results_for_builtin_patterns(tmp_path)
     assert set(core.find_files(str(tmp_path))) == legacy_results
 
 
+def test_directory_only_pattern_does_not_match_same_named_file(tmp_path):
+    """A trailing slash keeps pathlib.rglob's directory-only semantics."""
+    _write_files(
+        tmp_path,
+        {
+            "manifests/package.json",
+            "nested/manifests",
+        },
+    )
+    patterns = {
+        "test": {
+            "directory-only": {"pattern": "manifests/"},
+        },
+    }
+
+    assert _make_core(patterns=patterns).find_files(str(tmp_path)) == []
+
+
 def test_prunes_git_default_globs_and_exclude_paths_before_descent(
         tmp_path, mocker, caplog
 ):