Surface walker-pruned subtrees and add walker filter test coverage

Walker-level path-filter prunes were previously silent: pathFilterIntercept
short-circuits before any strategy reaches the directory, and there was no
log trail explaining why a project the user expected didn't appear in the
analyze summary. The post-summary note even pointed at `fossa list-targets`
as a workaround, which deliberately ignores all filters.

Wire `Has Logger sig m` through `walkWithFilters'` and `pathFilterIntercept`
so the walker can speak. Per-prune log lines fire at debug level (one per
strategy, ~28 strategies = noisy at info). Add `enumeratePrunedSubtrees`,
a one-shot pre-discovery walk that returns the list of subtrees the filter
will reject; analyze invokes it once before strategies run and logs each
pruned path at info level. Result for a `.fossa.yml` with
`paths.exclude: ["**/zip/**"]`:

  Active exclude glob filters: **/zip/**
  Skipping path "zip/" (excluded by paths filter)

The Has Logger ripple touches every strategy that uses walkWithFilters'
(~32 single-line constraint sites, ~7 multi-line). Each carrier already
provides Logger via DiscoverTaskEffs, so the change is purely a constraint
propagation — no new effects, no runtime cost.

Add three Walker spec tests (test/Discovery/WalkSpec.hs):
- include-path filter: mirror of the existing exclude test, asserts the
  walker accepts ancestors + included subtree and prunes siblings.
- WalkSkipSome merge: strategy returns WalkSkipSome ["a"], filter
  excludes "b", both should be pruned. Catches the
  `pathFilterIntercept`/`skipDisallowed` merge logic.
- YAML-to-walker end-to-end: parses a YAML config string with a glob
  exclude, runs it through `collectConfigFileFilters`, executes the
  walker, asserts pruning. Catches "globs parse but never reach the
  walker" wiring regressions — the exact class of bug we hit earlier.

Cannot exercise the new tests locally because the test binary's startup
reads test/Container/testdata/emptypath.tar (a git-LFS pointer not
materialized in this environment); CI's Linux/macOS/Windows jobs will
validate. Library and test-binary builds pass with no warnings.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: zlav

Changelog.md

@@ -2,7 +2,8 @@
 
 ## 3.17.4
 
-- Config: `paths.only` and `paths.exclude` in `.fossa.yml` now accept glob patterns (e.g. `**/vendor/**`, `node_modules/*`). Entries containing `*`, `?`, or `[` are parsed as globs; other entries keep their existing directory-tree semantics. ([#1703](https://github.com/fossas/fossa-cli/pull/1703))
+- Config: `paths.only` and `paths.exclude` in `.fossa.yml` now accept glob patterns (e.g. `**/vendor/**`, `node_modules/*`). An entry is treated as a glob if it contains `*`; other entries keep their existing directory-tree semantics. Glob matching follows [`System.FilePattern`](https://hackage.haskell.org/package/filepattern) semantics: `*` matches any sequence of characters within a single path segment, and `**` matches any number of segments. Patterns use forward slashes; backslashes are normalized so Windows-native patterns also work. ([#1703](https://github.com/fossas/fossa-cli/pull/1703))
+- Analyze: At startup, `fossa analyze` now prints (a) the active `paths.only`/`paths.exclude` filters from `.fossa.yml` and (b) the directories the walker will prune as a result. Each pruned subtree is reported once at info level so users can correlate a missing project with a configured filter. Per-prune trace logging during discovery is at debug level and visible with `--debug`. ([#1703](https://github.com/fossas/fossa-cli/pull/1703))
 
 ## 3.17.3
 

src/App/Fossa/Analyze.hs

@@ -121,7 +121,7 @@ import Data.Aeson qualified as Aeson
 import Data.ByteString.Lazy qualified as BL
 import Data.Error (createBody)
 import Data.Flag (Flag, fromFlag)
-import Data.Foldable (traverse_)
+import Data.Foldable (for_, traverse_)
 import Data.Functor (($>))
 import Data.Glob (unGlob)
 import Data.List.NonEmpty qualified as NE
@@ -137,6 +137,7 @@ import Diag.Result (resultToMaybe)
 import Discovery.Archive qualified as Archive
 import Discovery.Filters (AllFilters (..), MavenScopeFilters, applyFilters, combinedPathGlobs, combinedPaths, filterIsVSIOnly, ignoredPaths, isDefaultNonProductionPath)
 import Discovery.Projects (withDiscoveredProjects)
+import Discovery.Walk (enumeratePrunedSubtrees)
 import Effect.Exec (Exec)
 import Effect.Logger (
   Logger,
@@ -145,6 +146,7 @@ import Effect.Logger (
   logInfo,
   logStdout,
   renderIt,
+  viaShow,
  )
 import Effect.ReadFS (ReadFS)
 import Errata (Errata (..))
@@ -317,6 +319,23 @@ logActivePathFilters AllFilters{includeFilters = include, excludeFilters = exclu
       logInfo $
         "Active " <> pretty label <> " filters: " <> pretty (Text.intercalate ", " items)
 
+-- | Walk the tree once at startup and surface every directory the path
+-- filters will prune. Each prune is logged once at info level here, instead
+-- of emitting per-strategy duplicates from inside the walker (~28 strategies
+-- would otherwise each report the same prune).
+logPrunedSubtrees ::
+  ( Has Logger sig m
+  , Has ReadFS sig m
+  , Has Diag.Diagnostics sig m
+  ) =>
+  AllFilters ->
+  Path Abs Dir ->
+  m ()
+logPrunedSubtrees filters basedir = do
+  pruned <- enumeratePrunedSubtrees filters basedir
+  for_ pruned $ \p ->
+    logInfo $ "Skipping path " <> viaShow p <> " (excluded by paths filter)"
+
 analyze ::
   ( Has Debug sig m
   , Has Diag.Diagnostics sig m
@@ -353,6 +372,7 @@ analyze cfg = Diag.context "fossa-analyze" $ do
       enableVendetta = Config.xVendetta cfg
 
   logActivePathFilters filters
+  logPrunedSubtrees filters basedir
 
   manualDepsResult <-
     Diag.errorBoundaryIO . diagToDebug $

src/Discovery/Walk.hs

@@ -5,6 +5,7 @@ module Discovery.Walk (
   walkWithFilters',
   WalkStep (..),
   findFileInAncestor,
+  enumeratePrunedSubtrees,
 
   -- * Helpers
   fileName,
@@ -19,7 +20,7 @@ import Control.Effect.Reader (Reader, ask)
 import Control.Monad.Trans
 import Control.Monad.Trans.Maybe
 import Data.Bifunctor (second)
-import Data.Foldable (find)
+import Data.Foldable (find, traverse_)
 import Data.Functor (void)
 import Data.Glob qualified as Glob
 import Data.List ((\\))
@@ -28,6 +29,7 @@ import Data.Set qualified as Set
 import Data.String.Conversion (toString, toText)
 import Data.Text (Text)
 import Discovery.Filters (AllFilters, pathAllowed)
+import Effect.Logger (Logger, logDebug, viaShow)
 import Effect.ReadFS
 import Path
 
@@ -68,7 +70,8 @@ walk f = walkDir $ \dir subdirs files -> do
     WalkStop -> pure WalkFinish
 
 pathFilterIntercept ::
-  ( Applicative m
+  ( Has Logger sig m
+  , Monad m
   , Monoid o
   ) =>
   AllFilters ->
@@ -84,17 +87,34 @@ pathFilterIntercept filters base dir subdirs act = do
     Nothing -> act
     Just relative ->
       if pathAllowed filters relative
-        then (fmap . second) skipDisallowed act
-        else pure (mempty, WalkSkipAll)
+        then do
+          traverse_ logSkip disallowedRelativeSubdirs
+          (fmap . second) skipDisallowed act
+        else do
+          logSkip relative
+          pure (mempty, WalkSkipAll)
   where
-    disallowedSubdirs :: [Text]
-    disallowedSubdirs = do
+    -- Returns the list of immediate subdirectories that the filter rejects,
+    -- paired with their relative-to-base paths (for logging) and their bare
+    -- directory names (for the WalkStep skip list the walker consumes).
+    disallowedRelativeSubdirs :: [Path Rel Dir]
+    disallowedRelativeSubdirs = do
       subdir <- subdirs
       stripped <- stripProperPrefix base subdir
-      let isAllowed = pathAllowed filters stripped
-      if isAllowed
+      if pathAllowed filters stripped
         then mempty
-        else pure $ (toText . toFilePath . dirname) subdir
+        else pure stripped
+
+    disallowedSubdirs :: [Text]
+    disallowedSubdirs = map (toText . toFilePath . dirname) disallowedRelativeSubdirs
+
+    -- Per-prune events fire once per strategy walk, so emitting at info-level
+    -- here would surface N copies of every prune (one per strategy that walks
+    -- the tree). 'enumeratePrunedSubtrees' surfaces each prune once at info
+    -- before discovery begins; this debug line is for trace-level diagnostics.
+    logSkip :: Has Logger sig m => Path Rel Dir -> m ()
+    logSkip relPath =
+      logDebug $ "Skipping " <> viaShow relPath <> " (excluded by paths filter)"
 
     -- skipDisallowed needs to look at either:
     --  * WalkStep.WalkContinue
@@ -130,10 +150,12 @@ walk' f base = do
       tell res
       pure step
 
--- | Like @walk'@, but ignores paths that don't match the provided filters.
+-- | Like @walk'@, but ignores paths that don't match the provided filters and
+-- emits a log line for each subdirectory pruned by the filters.
 walkWithFilters' ::
   ( Has ReadFS sig m
   , Has Diagnostics sig m
+  , Has Logger sig m
   , Has (Reader AllFilters) sig m
   , Monoid o
   ) =>
@@ -145,6 +167,27 @@ walkWithFilters' f root = do
   let f' dir subdirs files = pathFilterIntercept filters root dir subdirs $ f dir subdirs files
   walk' f' root
 
+-- | Return the relative-to-root paths of every directory pruned by the
+-- 'AllFilters' include/exclude path rules. Useful for surfacing pruned dirs
+-- to the user once at startup, before any per-strategy walks (which would
+-- otherwise emit one log per strategy that reaches the same prune).
+enumeratePrunedSubtrees ::
+  ( Has ReadFS sig m
+  , Has Diagnostics sig m
+  ) =>
+  AllFilters ->
+  Path Abs Dir ->
+  m [Path Rel Dir]
+enumeratePrunedSubtrees filters root = walk' visit root
+  where
+    visit _dir subdirs _files = do
+      let pruned = do
+            subdir <- subdirs
+            stripped <- maybe [] pure (stripProperPrefix root subdir)
+            if pathAllowed filters stripped then [] else [stripped]
+          skipNames = map (toText . toFilePath . dirname) pruned
+      pure (pruned, WalkSkipSome skipNames)
+
 -- | Search upwards in the directory tree for the existence of the supplied file.
 findFileInAncestor :: (Has ReadFS sig m, Has Diagnostics sig m) => Path Abs Dir -> Text -> m (Path Abs File)
 findFileInAncestor dir file = do

src/Strategy/ApkDatabase.hs

@@ -18,6 +18,7 @@ import Discovery.Walk (
   findFileNamed,
   walkWithFilters',
  )
+import Effect.Logger (Logger)
 import Effect.ReadFS (Has, ReadFS)
 import GHC.Generics (Generic)
 import Path (Abs, Dir, File, Path)
@@ -44,6 +45,7 @@ instance AnalyzeProject AlpineDatabase where
 discover ::
   ( Has ReadFS sig m
   , Has Diagnostics sig m
+  , Has Logger sig m
   , Has (Reader AllFilters) sig m
   ) =>
   OsInfo ->
@@ -54,6 +56,7 @@ discover osInfo = simpleDiscover (findProjects osInfo) mkProject AlpineDatabaseP
 findProjects ::
   ( Has ReadFS sig m
   , Has Diagnostics sig m
+  , Has Logger sig m
   , Has (Reader AllFilters) sig m
   ) =>
   OsInfo ->

src/Strategy/BerkeleyDB.hs

@@ -53,6 +53,7 @@ instance AnalyzeProject BerkeleyDatabase where
 discover ::
   ( Has ReadFS sig m
   , Has Diagnostics sig m
+  , Has Logger sig m
   , Has (Reader AllFilters) sig m
   ) =>
   OsInfo ->
@@ -63,6 +64,7 @@ discover osInfo = simpleDiscover (findProjects osInfo) mkProject BerkeleyDBProje
 findProjects ::
   ( Has ReadFS sig m
   , Has Diagnostics sig m
+  , Has Logger sig m
   , Has (Reader AllFilters) sig m
   ) =>
   OsInfo ->

src/Strategy/Bundler.hs

@@ -37,6 +37,7 @@ import Discovery.Walk (
   walkWithFilters',
  )
 import Effect.Exec (Exec, GetDepsEffs, Has)
+import Effect.Logger (Logger)
 import Effect.ReadFS (ReadFS, readContentsParser)
 import GHC.Generics (Generic)
 import Path (Abs, Dir, File, Path, toFilePath)
@@ -58,10 +59,10 @@ import Types (
   LicenseType (UnknownType),
  )
 
-discover :: (Has ReadFS sig m, Has Diagnostics sig m, Has (Reader AllFilters) sig m) => Path Abs Dir -> m [DiscoveredProject BundlerProject]
+discover :: (Has ReadFS sig m, Has Diagnostics sig m, Has Logger sig m, Has (Reader AllFilters) sig m) => Path Abs Dir -> m [DiscoveredProject BundlerProject]
 discover = simpleDiscover findProjects mkProject BundlerProjectType
 
-findProjects :: (Has ReadFS sig m, Has Diagnostics sig m, Has (Reader AllFilters) sig m) => Path Abs Dir -> m [BundlerProject]
+findProjects :: (Has ReadFS sig m, Has Diagnostics sig m, Has Logger sig m, Has (Reader AllFilters) sig m) => Path Abs Dir -> m [BundlerProject]
 findProjects = walkWithFilters' $ \dir _ files -> do
   let maybeGemfile = findFileNamed "Gemfile" files
       gemfileLock = findFileNamed "Gemfile.lock" files

src/Strategy/Cargo.hs

@@ -80,6 +80,7 @@ import Effect.Grapher (
   label,
   withLabeling,
  )
+import Effect.Logger (Logger)
 import Effect.ReadFS (ReadFS, doesFileExist, readContentsToml)
 import Errata (Errata (..))
 import GHC.Generics (Generic)
@@ -220,10 +221,10 @@ instance FromJSON CargoMetadata where
       <*> (obj .: "workspace_members" >>= traverse parsePkgId)
       <*> obj .: "resolve"
 
-discover :: (Has ReadFS sig m, Has Diagnostics sig m, Has (Reader AllFilters) sig m) => Path Abs Dir -> m [DiscoveredProject CargoProject]
+discover :: (Has ReadFS sig m, Has Diagnostics sig m, Has Logger sig m, Has (Reader AllFilters) sig m) => Path Abs Dir -> m [DiscoveredProject CargoProject]
 discover = simpleDiscover findProjects mkProject CargoProjectType
 
-findProjects :: (Has ReadFS sig m, Has Diagnostics sig m, Has (Reader AllFilters) sig m) => Path Abs Dir -> m [CargoProject]
+findProjects :: (Has ReadFS sig m, Has Diagnostics sig m, Has Logger sig m, Has (Reader AllFilters) sig m) => Path Abs Dir -> m [CargoProject]
 findProjects = walkWithFilters' $ \dir _ files -> do
   case findFileNamed "Cargo.toml" files of
     Nothing -> pure ([], WalkContinue)

src/Strategy/Carthage.hs

@@ -46,6 +46,7 @@ import Discovery.Walk (
   walkWithFilters',
  )
 import Effect.Grapher (Grapher, direct, edge, evalGrapher)
+import Effect.Logger (Logger)
 import Effect.ReadFS (ReadFS, readContentsParser)
 import Errata (Errata (..))
 import GHC.Generics (Generic)
@@ -81,10 +82,10 @@ import Types (
   GraphBreadth (Complete),
  )
 
-discover :: (Has ReadFS sig m, Has Diagnostics sig m, Has (Reader AllFilters) sig m) => Path Abs Dir -> m [DiscoveredProject CarthageProject]
+discover :: (Has ReadFS sig m, Has Diagnostics sig m, Has Logger sig m, Has (Reader AllFilters) sig m) => Path Abs Dir -> m [DiscoveredProject CarthageProject]
 discover = simpleDiscover findProjects mkProject CarthageProjectType
 
-findProjects :: (Has ReadFS sig m, Has Diagnostics sig m, Has (Reader AllFilters) sig m) => Path Abs Dir -> m [CarthageProject]
+findProjects :: (Has ReadFS sig m, Has Diagnostics sig m, Has Logger sig m, Has (Reader AllFilters) sig m) => Path Abs Dir -> m [CarthageProject]
 findProjects = walkWithFilters' $ \dir _ files -> do
   case findFileNamed "Cartfile.resolved" files of
     Nothing -> pure ([], WalkContinue)

src/Strategy/Cocoapods.hs

@@ -48,10 +48,10 @@ import Types (
   LicenseType (UnknownType),
  )
 
-discover :: (Has ReadFS sig m, Has Diagnostics sig m, Has (Reader AllFilters) sig m) => Path Abs Dir -> m [DiscoveredProject CocoapodsProject]
+discover :: (Has ReadFS sig m, Has Diagnostics sig m, Has Logger sig m, Has (Reader AllFilters) sig m) => Path Abs Dir -> m [DiscoveredProject CocoapodsProject]
 discover = simpleDiscover findProjects mkProject CocoapodsProjectType
 
-findProjects :: (Has ReadFS sig m, Has Diagnostics sig m, Has (Reader AllFilters) sig m) => Path Abs Dir -> m [CocoapodsProject]
+findProjects :: (Has ReadFS sig m, Has Diagnostics sig m, Has Logger sig m, Has (Reader AllFilters) sig m) => Path Abs Dir -> m [CocoapodsProject]
 findProjects = walkWithFilters' $ \dir _ files -> do
   let podfile = findFileNamed "Podfile" files
       podfileLock = findFileNamed "Podfile.lock" files

src/Strategy/Composer.hs

@@ -52,6 +52,7 @@ import Effect.Grapher (
   label,
   withLabeling,
  )
+import Effect.Logger (Logger)
 import Effect.ReadFS (ReadFS, readContentsJson)
 import GHC.Generics (Generic)
 import Graphing (Graphing)
@@ -66,10 +67,10 @@ import Types (
   LicenseType (LicenseSPDX),
  )
 
-discover :: (Has ReadFS sig m, Has Diagnostics sig m, Has (Reader AllFilters) sig m) => Path Abs Dir -> m [DiscoveredProject ComposerProject]
+discover :: (Has ReadFS sig m, Has Diagnostics sig m, Has Logger sig m, Has (Reader AllFilters) sig m) => Path Abs Dir -> m [DiscoveredProject ComposerProject]
 discover = simpleDiscover findProjects mkProject ComposerProjectType
 
-findProjects :: (Has ReadFS sig m, Has Diagnostics sig m, Has (Reader AllFilters) sig m) => Path Abs Dir -> m [ComposerProject]
+findProjects :: (Has ReadFS sig m, Has Diagnostics sig m, Has Logger sig m, Has (Reader AllFilters) sig m) => Path Abs Dir -> m [ComposerProject]
 findProjects = walkWithFilters' $ \dir _ files -> do
   case findFileNamed "composer.lock" files of
     Nothing -> pure ([], WalkContinue)