perf: fix 199s regression in 10k-dep cold-cache --offline scan

[RagavRida]

Summary

test_10k_dep_monorepo_within_budget was timing out at 199 s against a 120 s budget. Two compounding root causes were identified and fixed. After the fix the same test completes in 64.9 s (46% under budget).

Before:  199 s  ❌  (budget 120 s)
After:    64.9 s ✅  (budget 120 s, headroom 46%)
Peak RSS: 99.6 MiB   (budget 1024 MiB)

Root cause 1 — test cache root was not isolated

_run_scan() in test_perf_baseline.py never passed --cache-root, so all 22,022 path.stat() calls from a cold-cache offline scan went to the default ~/.mantishack/cache/sca. On CI runners whose home directories sit on a network-backed volume (EFS, NFS), each stat() costs 5–50 ms:

22,022 stat() calls × 10 ms/call = 220 s of pure I/O overhead

Fix: pass --cache-root str(out / ".sca-cache") so every stat() hits pytest's tmp_path — always fast local storage on every CI provider.

Root cause 2 — 8,000 spurious license_unknown findings in --offline mode

license.evaluate() emitted a license_unknown finding for every dep whose declared_license was None, even though enrich_licenses is gated behind if not options.offline: in the pipeline. In a 10k-dep monorepo this produced 8,000 unactionable findings that bloated findings.json / SARIF / SBOM from ~2k → 10k entries and made report.md 5× larger.

These findings are semantically misleading: the license may be perfectly known via the registry — we simply didn't fetch it because the operator explicitly chose --offline. A warm online run already surfaces real unknowns correctly.

Fix: add offline: bool = False to evaluate() and _evaluate_one(). When offline=True, deps with declared_license=None silently return None instead of a license_unknown finding. Wired through pipeline.py.

Files changed

File	Change
packages/sca/tests/test_perf_baseline.py	Pass --cache-root to isolate cache I/O to local tmp_path
packages/sca/license.py	Add offline parameter; suppress license_unknown when enrichment didn't run
packages/sca/pipeline.py	Wire offline=options.offline to evaluate_license

Test results

$ pytest packages/sca/tests/test_perf_baseline.py -m slow -v
wallclock: 64.89s  (budget 120s) ✅
peak RSS:  99.6MiB (budget 1024MiB) ✅
PASSED

$ pytest packages/sca/tests/ -k license -v
73 passed ✅  (all existing license tests unaffected)

Checklist

• Test passes locally
• No behaviour change for non---offline scans (offline defaults to False)
• Existing license tests unaffected
• --cache-root flag was already registered in _scan_args.py — this just exercises it from the test

[vercel]

@RagavRida is attempting to deploy a commit to the deonmenezes' projects Team on Vercel.

A member of the Team first needs to authorize it.