This repository was archived by the owner on May 29, 2026. It is now read-only.
ci: disable SBOM until @conduction/nextcloud-vue dep declarations are cleaned up (#434)#435
Merged
Conversation
… cleaned up (#434) The SBOM job's npm step (`@cyclonedx/cyclonedx-npm`) fails because its internal `npm ls` exits ELSPROBLEMS on nc-vue's dependency-tree inconsistencies (bootstrap-vue is a non-optional peer, apexcharts/pinia/vue version ranges don't match what apps install, @types/react via a transitive rehype-react). `--package-lock-only` doesn't sidestep it. No other Conduction app enables SBOM. Turn it off here too until the upstream dep cleanup happens — see #434.
rubenvdlinde
requested review from
Rem-Dam,
SudoThijn,
WilcoLouwerse,
bbrands02,
remko48 and
rjzondervan
as code owners
Contributor
Quality Report — ConductionNL/procest @
|
| Check | PHP | Vue | Security | License | Tests |
|---|---|---|---|---|---|
| lint | ✅ | ||||
| phpcs | ✅ | ||||
| phpmd | ✅ | ||||
| psalm | ✅ | ||||
| phpstan | ✅ | ||||
| phpmetrics | ✅ | ||||
| eslint | ✅ | ||||
| stylelint | ✅ | ||||
| composer | ✅ | ✅ 100/100 | |||
| npm | ✅ | ✅ 420/420 | |||
| PHPUnit | ✅ | ||||
| Newman | ⏭️ | ||||
| Playwright | ❌ |
Coverage: 0% (0/81 statements)
Spec coverage: 7% (30 tests / 456 specs)
Quality workflow — 2026-05-13 04:59 UTC
Download the full PDF report from the workflow artifacts.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The
SBOMjob fails ondevelopment(and any PR run that reaches it):npx @cyclonedx/cyclonedx-npminvokesnpm lsinternally, andnpm lsexitsELSPROBLEMSbecause procest's installed tree doesn't satisfy@conduction/nextcloud-vue's declarations —bootstrap-vueis a non-optional peer,apexcharts/pinia/vuecome out "invalid" against its ranges,@types/reactis pulled in (optionally) by a transitiverehype-react.--package-lock-onlydoesn't help (cyclonedx-npm passes it straight tonpm ls). No other Conduction app enablesenable-sbom.Set
enable-sbom: falsehere too until the upstream nc-vue dependency cleanup happens — tracked in #434. (Separately,quality.ymlwas already updated to make the unrelated coverage-baselinegit pushnon-blocking — ConductionNL/.github#62 — and #61 tracks adding the CI bot as a ruleset bypass actor.)After this, every gate in procest's "Code Quality" workflow is green.