Scala setup instructions

Note: the following only applies to projects using build.sbt. If your project uses gradle, you should look at socket manifest gradle --help. If your project uses pom.xml files, you can skip this step for a regular scan since the Socket backend can handle pom files directly — but see the reachability note below, which applies to Maven too.

Generating manifest files with sbt

You can run socket manifest scala from your source dir. By default it invokes sbt to generate a single Socket facts file (.socket.facts.json) describing your project's resolved dependency graph. Once generated these can be uploaded by running socket scan create in the same dir.

You can specify the input folder, the location of the sbt binary to use, and the output folder through the command flags. See socket manifest scala --help for details on this. You can also pass through additional options to sbt.

Once you have created the manifest(s) you can create a report by running socket scan createin the target dir.

Reachability: For full application reachability scans, we recommend socket scan create --reach --dynamic-sbom-inference. Manifests are generated as part of the scan for every sbt build under the scan target (not just the one at the root), and reachability is analyzed and reported per subproject. It works from the dependency graph sbt itself resolves, including where each dependency lives, so the analysis can reliably install the dependencies it needs.