Stop guessing the SCM host from the Socket diff URL

get_manifest_file_url fell back to substring-matching diff.diff_url for
"github"/"gitlab"/"bitbucket" when config had no scm. CliConfig always
sets scm, and without a config there is no repository_url to use, so the
guess never affected a link. diff_url also points at Socket rather than
the SCM. Remove the branch so only config picks the SCM, which clears
the CodeQL incomplete-URL-substring-sanitization alert.

Author: lelia

socketsecurity/core/messages.py

@@ -78,18 +78,10 @@ def get_manifest_file_url(diff: Diff, manifest_path: str, config=None) -> str:
         # Remove leading slashes
         clean_path = clean_path.lstrip('/')
 
-        # Determine SCM type from config or diff_url
-        scm_type = "api"  # Default to API
+        # diff.diff_url points at Socket, not the SCM, so only config decides.
+        scm_type = "api"
         if config and hasattr(config, 'scm'):
             scm_type = config.scm.lower()
-        elif hasattr(diff, 'diff_url') and diff.diff_url:
-            diff_url = diff.diff_url.lower()
-            if 'github.com' in diff_url or 'github' in diff_url:
-                scm_type = "github"
-            elif 'gitlab' in diff_url:
-                scm_type = "gitlab"
-            elif 'bitbucket' in diff_url:
-                scm_type = "bitbucket"
 
         # Generate URL based on SCM type using config information
         # NEVER use diff.diff_url for SCM URLs - those are Socket URLs for "View report" links

tests/unit/test_messages.py

@@ -102,3 +102,21 @@ def test_manifest_link_falls_back_to_the_report_without_a_repository_url():
     url = Messages.get_manifest_file_url(diff, "app/package.json", config)
 
     assert url == "https://socket.dev/report/123?tab=files&file=app%2Fpackage.json"
+
+
+
+def test_manifest_link_does_not_guess_the_scm_from_the_diff_url():
+    """Without an explicit scm, a GitHub-looking diff_url falls back to the report."""
+
+    class _NoScmConfig:
+        branch = "main"
+        repository_url = "https://github.com/acme/widgets"
+
+    diff = Diff(
+        diff_url="https://github.com/acme/widgets/pull/1",
+        report_url="https://socket.dev/report/123",
+    )
+
+    url = Messages.get_manifest_file_url(diff, "app/package.json", _NoScmConfig())
+
+    assert url == "https://socket.dev/report/123?tab=files&file=app%2Fpackage.json"