From 12d7317f6c65b43f9f722784b63def9570de3115 Mon Sep 17 00:00:00 2001 From: Ruben van der Linde Date: Wed, 13 May 2026 06:27:42 +0200 Subject: [PATCH] fix(quality): SBOM via package-lock; non-blocking coverage-baseline push MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - SBOM 'Generate npm SBOM' step ran 'npx @cyclonedx/cyclonedx-npm ...' which invokes 'npm ls' under the hood; that exits ELSPROBLEMS on benign dependency- tree quirks (peer/version mismatches in transitive deps, a hard dep declared by a lib but deduped away). Switch to --package-lock-only so the SBOM is built from package-lock.json (the deterministic source of truth) — a fix, not an --ignore-npm-errors. (The underlying dep-declaration noise — e.g. nc-vue listing bootstrap-vue as a hard dependency — should still be cleaned up at the library level.) - update-baseline: 'git push' of the auto-committed .coverage-baseline is rejected by the org branch-protection rulesets (GH013) on repos with a protected development/main, failing the whole workflow. Make it non-blocking (warn instead of fail) until the bot is added as a ruleset bypass actor — tracked in ConductionNL/.github#61. --- .github/workflows/quality.yml | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-) diff --git a/.github/workflows/quality.yml b/.github/workflows/quality.yml index fff4c44a..5805445c 100644 --- a/.github/workflows/quality.yml +++ b/.github/workflows/quality.yml @@ -1299,7 +1299,11 @@ jobs: else git add .coverage-baseline git commit -m "ci: update coverage baseline [skip ci]" - git push + # Non-blocking: branch-protection rulesets reject the bot push on + # repos with a protected development/main. Surface a warning instead + # of failing the whole workflow over an auto-committed convenience + # file. Tracked in ConductionNL/.github#61 (add bot as a bypass actor). + git push || echo "::warning::Could not push the updated coverage baseline — branch protection rejected the bot push (see ConductionNL/.github#61). Commit .coverage-baseline manually." fi report: @@ -1568,7 +1572,12 @@ jobs: - name: Generate npm SBOM if: ${{ inputs.enable-frontend }} - run: npx @cyclonedx/cyclonedx-npm --output-file bom-npm.cdx.json --spec-version 1.5 --omit dev + # --package-lock-only: build the SBOM from package-lock.json rather than + # `npm ls`. `npm ls` exits non-zero (ELSPROBLEMS) on benign tree quirks — + # peer/version mismatches in transitive deps, a hard dependency declared + # by a lib but deduped away, etc. — which has nothing to do with the SBOM. + # The lockfile is the deterministic source of truth for what gets installed. + run: npx @cyclonedx/cyclonedx-npm --package-lock-only --output-file bom-npm.cdx.json --spec-version 1.5 --omit dev - name: Merge PHP + npm SBOMs if: ${{ inputs.enable-frontend }}