Skip to content

[AAASM-3723] 🐛 (ci): Fix CycloneDX SBOM npm-ls tree check in release-node.yml #194

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
Chisanan232 merged 1 commit into from
Jun 25, 2026
Merged

[AAASM-3723] 🐛 (ci): Fix CycloneDX SBOM npm-ls tree check in release-node.yml #194

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
13 changes: 12 additions & 1 deletion .github/workflows/release-node.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -303,8 +303,19 @@ jobs:
# provenance (NPM_CONFIG_PROVENANCE above). Runs on every dispatch
# (incl. dry-run) so a dry-run validates generation; the real-publish
# path attaches it to the GitHub Release below.
#
# AAASM-3723: this repo installs with `pnpm install --frozen-lockfile`,
# so node_modules is pnpm's symlinked layout with no package-lock.json.
# cyclonedx-npm shells out to `npm ls` to walk the tree, which flags
# devDependencies of transitive deps (e.g. safe-publish-latest required
# by math-intrinsics) as "missing" and exits non-zero — aborting the
# release before publish. `--omit dev` builds a production-only tree
# (the right scope for a release SBOM anyway), and `--ignore-npm-errors`
# tolerates the residual npm-ls noise from the pnpm node_modules layout.
# This is purely the dependency-manifest step; it does not touch the
# OIDC trusted-publish / SLSA provenance path below.
- name: Generate CycloneDX SBOM
run: pnpm dlx @cyclonedx/cyclonedx-npm --output-format JSON --output-file sbom.cdx.json
run: pnpm dlx @cyclonedx/cyclonedx-npm --omit dev --ignore-npm-errors --output-format JSON --output-file sbom.cdx.json

- name: Upload SBOM artifact
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
Expand Down
Loading