CM-67391: Fix secret presigned upload test mocks and harden fallback

Switching secret scans to the presigned upload path routed them through
get_upload_link -> S3 -> scan_repository_from_upload_id, none of which
were registered by mock_scan_async_responses. The scan hit an unmocked
endpoint, returned 0 violations, and failed test_passing_output_option.

- Extend mock_scan_async_responses to register the presigned endpoints
  (upload-link, S3 POST, repository) for presigned scan types, branching
  on should_use_presigned_upload.
- Widen the presigned-upload fallback in _perform_scan to also catch the
  client's wrapped RequestError/SlowUploadConnectionError, not just raw
  requests.RequestException. A connection/timeout error from get_upload_link
  or the scan trigger otherwise never fell back to the Cycode-API upload.
- Add a regression test covering the wrapped-exception fallback.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: ilia-cy

cycode/cli/apps/scan/code_scanner.py

@@ -391,7 +391,11 @@ def _perform_scan(
                 is_commit_range,
                 on_upload_progress,
             )
-        except requests.exceptions.RequestException:
+        except (
+            requests.exceptions.RequestException,
+            custom_exceptions.RequestError,
+            custom_exceptions.SlowUploadConnectionError,
+        ):
             logger.warning('Direct upload to object storage failed. Falling back to upload via Cycode API. ')
 
     return _perform_scan_async(

tests/cli/commands/scan/test_code_scanner.py

@@ -5,7 +5,8 @@
 import pytest
 
 from cycode.cli import consts
-from cycode.cli.apps.scan.code_scanner import scan_disk_files, scan_documents
+from cycode.cli.apps.scan.code_scanner import _perform_scan, scan_disk_files, scan_documents
+from cycode.cli.exceptions import custom_exceptions
 from cycode.cli.files_collector.file_excluder import _is_file_relevant_for_sca_scan
 from cycode.cli.files_collector.path_documents import _generate_document
 from cycode.cli.models import Document
@@ -212,3 +213,27 @@ def test_scan_documents_routes_upload_by_scan_type_and_sync(
 
     assert mock_presigned_upload.called is expect_presigned
     assert mock_batched_scan.called is (not expect_presigned)
+
+
+@patch('cycode.cli.apps.scan.code_scanner._perform_scan_async')
+@patch('cycode.cli.apps.scan.code_scanner._perform_scan_v4_async')
+def test_perform_scan_falls_back_to_api_when_presigned_upload_raises_wrapped_error(
+    mock_v4_async: Mock, mock_async: Mock
+) -> None:
+    # RequestConnectionError is a CycodeError, not a requests.RequestException — the fallback must still catch it.
+    mock_v4_async.side_effect = custom_exceptions.RequestConnectionError
+    fallback_result = object()
+    mock_async.return_value = fallback_result
+
+    result = _perform_scan(
+        cycode_client=MagicMock(),
+        zipped_documents=MagicMock(),
+        scan_type=consts.SAST_SCAN_TYPE,
+        is_git_diff=False,
+        is_commit_range=False,
+        scan_parameters={},
+    )
+
+    assert result is fallback_result
+    mock_v4_async.assert_called_once()
+    mock_async.assert_called_once()

tests/cyclient/mocked_responses/scan_client.py

@@ -5,6 +5,7 @@
 
 import responses
 
+from cycode.cli.utils.scan_utils import should_use_presigned_upload
 from cycode.cyclient.scan_client import ScanClient
 from tests.conftest import MOCKED_RESPONSES_PATH
 
@@ -128,6 +129,38 @@ def get_scan_configuration_response(url: str) -> responses.Response:
     return responses.Response(method=responses.GET, url=url, json=json_response, status=200)
 
 
+_PRESIGNED_UPLOAD_URL = 'https://cycode-tests.s3.amazonaws.com/presigned-upload'
+
+
+def get_upload_link_url(scan_type: str, scan_client: ScanClient) -> str:
+    api_url = scan_client.scan_cycode_client.api_url
+    async_scan_type = scan_client.scan_config.get_async_scan_type(scan_type)
+    service_url = f'{scan_client.get_scan_service_v4_url_path(scan_type)}/{async_scan_type}/upload-link'
+    return f'{api_url}/{service_url}'
+
+
+def get_upload_link_response(url: str) -> responses.Response:
+    json_response = {'upload_id': str(uuid4()), 'url': _PRESIGNED_UPLOAD_URL, 'presigned_post_fields': {}}
+    return responses.Response(method=responses.GET, url=url, json=json_response, status=200)
+
+
+def get_presigned_upload_response() -> responses.Response:
+    return responses.Response(method=responses.POST, url=_PRESIGNED_UPLOAD_URL, status=204)
+
+
+def get_scan_from_upload_id_url(scan_type: str, scan_client: ScanClient) -> str:
+    api_url = scan_client.scan_cycode_client.api_url
+    async_scan_type = scan_client.scan_config.get_async_scan_type(scan_type)
+    service_url = f'{scan_client.get_scan_service_v4_url_path(scan_type)}/{async_scan_type}/repository'
+    return f'{api_url}/{service_url}'
+
+
+def get_scan_from_upload_id_response(url: str, scan_id: Optional[UUID] = None) -> responses.Response:
+    if not scan_id:
+        scan_id = uuid4()
+    return responses.Response(method=responses.POST, url=url, json={'scan_id': str(scan_id)}, status=200)
+
+
 def mock_remote_config_responses(responses_module: responses, scan_type: str, scan_client: ScanClient) -> None:
     responses_module.add(get_scan_configuration_response(get_scan_configuration_url(scan_type, scan_client)))
 
@@ -136,9 +169,18 @@ def mock_scan_async_responses(
     responses_module: responses, scan_type: str, scan_client: ScanClient, scan_id: UUID, zip_content_path: Path
 ) -> None:
     mock_remote_config_responses(responses_module, scan_type, scan_client)
-    responses_module.add(
-        get_zipped_file_scan_async_response(get_zipped_file_scan_async_url(scan_type, scan_client), scan_id)
-    )
+
+    if should_use_presigned_upload(scan_type):
+        responses_module.add(get_upload_link_response(get_upload_link_url(scan_type, scan_client)))
+        responses_module.add(get_presigned_upload_response())
+        responses_module.add(
+            get_scan_from_upload_id_response(get_scan_from_upload_id_url(scan_type, scan_client), scan_id)
+        )
+    else:
+        responses_module.add(
+            get_zipped_file_scan_async_response(get_zipped_file_scan_async_url(scan_type, scan_client), scan_id)
+        )
+
     responses_module.add(get_scan_details_response(get_scan_details_url(scan_type, scan_id, scan_client), scan_id))
     responses_module.add(get_detection_rules_response(get_detection_rules_url(scan_client)))
     responses_module.add(get_scan_detections_response(get_scan_detections_url(scan_client), scan_id, zip_content_path))