Context
enable-sbom is currently false in .github/workflows/code-quality.yml (it was true, but the SBOM job has been failing).
Why it fails
The SBOM job's "Generate npm SBOM" step runs npx @cyclonedx/cyclonedx-npm …, which always invokes npm ls internally — and npm ls exits ELSPROBLEMS because procest's installed dependency tree doesn't satisfy @conduction/nextcloud-vue's declarations:
npm error invalid: vue@2.7.16
npm error missing: bootstrap-vue@^2.23.1, required by @conduction/nextcloud-vue@1.0.0-beta.40
npm error invalid: apexcharts@3.54.1
npm error missing: @types/react@>=17, required by rehype-react@7.2.0
npm error invalid: pinia@2.3.1
bootstrap-vue — declared as a (non-optional) peerDependency of @conduction/nextcloud-vue. It's only used by CnTabbedFormDialog / CnAdvancedFormDialog, so it should be peerDependenciesMeta: { "bootstrap-vue": { "optional": true } } — apps that don't use those components shouldn't be forced to install it. (nc-vue fix)apexcharts / pinia / vue — nc-vue's declared version ranges don't match what apps actually install (nc-vue beta wants apexcharts@^4.7.0, procest's lockfile has 3.54.1). Either align nc-vue's ranges with reality, or regenerate procest's lockfile against the current nc-vue (or both). (nc-vue + procest fix)@types/react — pulled in as an optional peer of a transitive rehype-react@7.2.0 (via @nextcloud/dialogs); npm ls flags it as missing. (transitive — likely resolves once nc-vue/@nextcloud/dialogs are updated)
@cyclonedx/cyclonedx-npm --package-lock-only does not sidestep this — it just adds --package-lock-only to the same npm ls invocation, which still reports the inconsistencies. The only built-in escape hatch is --ignore-npm-errors, which we're avoiding (it papers over the warnings rather than fixing the tree).
Acceptance
Set enable-sbom: true again once the nc-vue dependency declarations are cleaned up and npm ls runs clean for procest (verify locally: npm ci && npm ls --all >/dev/null).
Related: quality.yml already non-blocking-ifies the separate coverage-baseline git push (ConductionNL/.github#62) and tracks the ruleset bypass (ConductionNL/.github#61).
Context
enable-sbomis currentlyfalsein.github/workflows/code-quality.yml(it wastrue, but theSBOMjob has been failing).Why it fails
The
SBOMjob's "Generate npm SBOM" step runsnpx @cyclonedx/cyclonedx-npm …, which always invokesnpm lsinternally — andnpm lsexitsELSPROBLEMSbecause procest's installed dependency tree doesn't satisfy@conduction/nextcloud-vue's declarations:bootstrap-vue— declared as a (non-optional)peerDependencyof@conduction/nextcloud-vue. It's only used byCnTabbedFormDialog/CnAdvancedFormDialog, so it should bepeerDependenciesMeta: { "bootstrap-vue": { "optional": true } }— apps that don't use those components shouldn't be forced to install it. (nc-vue fix)apexcharts/pinia/vue— nc-vue's declared version ranges don't match what apps actually install (nc-vuebetawantsapexcharts@^4.7.0, procest's lockfile has3.54.1). Either align nc-vue's ranges with reality, or regenerate procest's lockfile against the current nc-vue (or both). (nc-vue + procest fix)@types/react— pulled in as an optional peer of a transitiverehype-react@7.2.0(via@nextcloud/dialogs);npm lsflags it as missing. (transitive — likely resolves once nc-vue/@nextcloud/dialogsare updated)@cyclonedx/cyclonedx-npm --package-lock-onlydoes not sidestep this — it just adds--package-lock-onlyto the samenpm lsinvocation, which still reports the inconsistencies. The only built-in escape hatch is--ignore-npm-errors, which we're avoiding (it papers over the warnings rather than fixing the tree).Acceptance
Set
enable-sbom: trueagain once the nc-vue dependency declarations are cleaned up andnpm lsruns clean for procest (verify locally:npm ci && npm ls --all >/dev/null).Related:
quality.ymlalready non-blocking-ifies the separate coverage-baselinegit push(ConductionNL/.github#62) and tracks the ruleset bypass (ConductionNL/.github#61).