ci: fix dependency-scan SBOM workflow to scan released packages by joker23 · Pull Request #1287 · launchdarkly/js-core

joker23 · 2026-04-16T21:38:46Z

Summary

The dependency-scan.yml workflow has been silently broken since it was added (SEC-7263, Nov 2025). Every run produces a 0-component SBOM and vacuously passes the license policy check.

Root cause: cdxgen internally runs yarn install but corepack was never enabled, so it fell back to system yarn 1.x, failed silently, and produced an empty BOM
Enable corepack and install only released package dependencies (via yarn workspaces focus) before cdxgen runs
Scopes the scan to published packages only, excluding example apps and contract tests that bring in LGPL-licensed dev tooling (e.g. @img/sharp-libvips via Next.js)

Changes

.github/workflows/dependency-scan.yml -- add node setup, corepack, and scoped dependency install before SBOM generation
scripts/released-packages.js -- new script that reads .release-please-manifest.json and prints workspace names of all released packages

Test plan

Verified locally: clean checkout (no yarn.lock, no node_modules) produces 970 packages with zero LGPL violations
Verify the Dependency Scan workflow runs green on this PR

Fixes SDK-2170

🤖 Generated with Claude Code

Note

Low Risk
Low risk since this only changes CI dependency-scanning behavior, but it could cause the Dependency Scan workflow to fail if Yarn workspace focusing or the released-packages list is incorrect.

Overview
Fixes the Dependency Scan GitHub Action so SBOM generation runs with the intended Node/Yarn toolchain and produces a non-empty BOM.

The workflow now sets up Node 20, enables corepack, installs dependencies for released workspaces via yarn workspaces focus $(node scripts/released-packages.js), and passes ensure-non-empty: 'true' to the SBOM generator.

Adds scripts/released-packages.js, which reads .release-please-manifest.json and prints the corresponding workspace package names to drive the focused install.

^{Reviewed by Cursor Bugbot for commit d73db95. Bugbot is set up for automated code reviews on this repo. Configure here.}

github-actions · 2026-04-16T21:40:13Z

@launchdarkly/js-sdk-common size report
This is the brotli compressed size of the ESM build.
Compressed size: 25623 bytes
Compressed size limit: 29000
Uncompressed size: 125843 bytes

github-actions · 2026-04-16T21:40:34Z

@launchdarkly/js-client-sdk size report
This is the brotli compressed size of the ESM build.
Compressed size: 31840 bytes
Compressed size limit: 34000
Uncompressed size: 113634 bytes

github-actions · 2026-04-16T21:40:38Z

@launchdarkly/browser size report
This is the brotli compressed size of the ESM build.
Compressed size: 179547 bytes
Compressed size limit: 200000
Uncompressed size: 830815 bytes

github-actions · 2026-04-16T21:40:49Z

@launchdarkly/js-client-sdk-common size report
This is the brotli compressed size of the ESM build.
Compressed size: 38473 bytes
Compressed size limit: 39000
Uncompressed size: 211104 bytes

devin-ai-integration

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no potential bugs to report.

View in Devin Review to see 1 additional finding.

joker23 · 2026-04-22T21:01:17Z

@cursor review

cursor

✅ Bugbot reviewed your changes and found no new issues!

1 issue from previous review remains unresolved.

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 4f896fa. Configure here.}

joker23 · 2026-04-22T21:26:01Z

Going to wait until launchdarkly/gh-actions#81 merges so we can ensure that the dependencies are present to be scanned.

joker23 · 2026-04-24T15:27:15Z

@cursor review

cursor

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 36b5ac5. Configure here.}

… SBOM The dependency-scan workflow has been silently broken since it was added (SEC-7263). cdxgen internally runs `yarn install` but corepack was never enabled, so it fell back to system yarn 1.x, failed silently, and produced a 0-component BOM. OPA then evaluated the empty BOM and vacuously passed. - Enable corepack and install deps before the shared generate-sbom action - Add a non-zero component guard so empty scans fail loudly - Document that this workflow checks license compliance, not CVEs Fixes: SDK-2170 Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Yarn Berry auto-enables immutable installs in CI, but this repo gitignores yarn.lock, so the install fails. Match the pattern used in react.yml. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Point generate-sbom at the skz/ignore-optional branch of gh-actions which adds --omit optional to cdxgen. This should exclude @img/sharp-libvips-* (LGPL-3.0, optional deps of sharp via Next.js) from the SBOM. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

…itives Revert the omit-optional gh-actions branch (didn't filter transitive optionals). Instead, set YARN_SUPPORTED_ARCHITECTURES to empty arrays so yarn skips all platform-specific optional deps (like @img/sharp-libvips-*) during install. If they're not in node_modules, cdxgen won't pick them up. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

YARN_SUPPORTED_ARCHITECTURES env var doesn't work as JSON in Yarn 3.4.1. Use yarn config set with --json flag to set each sub-key individually. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Use yarn workspaces focus to install only dependencies of released packages (from .release-please-manifest.json). This excludes example apps and contract tests that bring in LGPL transitive deps like @img/sharp-libvips (via Next.js) which don't ship in published SDKs. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

joker23 force-pushed the skz/sdk-2170/ci-SBOM branch 10 times, most recently from 6cec276 to 4a19c4d Compare April 21, 2026 22:56

joker23 marked this pull request as ready for review April 22, 2026 19:22

joker23 requested a review from a team as a code owner April 22, 2026 19:22

This comment was marked as resolved.

Sign in to view

devin-ai-integration Bot reviewed Apr 22, 2026

View reviewed changes

joker23 force-pushed the skz/sdk-2170/ci-SBOM branch from 4a19c4d to 4f896fa Compare April 22, 2026 20:20

joker23 changed the title ~~fix(ci): enable corepack in dependency-scan SBOM workflow~~ fix(ci): fix dependency-scan SBOM workflow to scan released packages Apr 22, 2026

cursor Bot reviewed Apr 22, 2026

View reviewed changes

joker23 force-pushed the skz/sdk-2170/ci-SBOM branch from 4f896fa to b2ce177 Compare April 22, 2026 21:13

joker23 marked this pull request as draft April 22, 2026 21:13

This comment was marked as resolved.

Sign in to view

joker23 mentioned this pull request Apr 22, 2026

fix(dependency-scan): add option to fail if bom file is empty launchdarkly/gh-actions#81

Merged

joker23 force-pushed the skz/sdk-2170/ci-SBOM branch 2 times, most recently from e9a4588 to cd8590e Compare April 24, 2026 14:20

joker23 force-pushed the skz/sdk-2170/ci-SBOM branch from cd8590e to 36b5ac5 Compare April 24, 2026 14:21

joker23 marked this pull request as ready for review April 24, 2026 14:23

cursor Bot reviewed Apr 24, 2026

View reviewed changes

joker23 and others added 6 commits April 24, 2026 16:01

fix(ci): disable immutable installs for dependency-scan

5f1f98f

Yarn Berry auto-enables immutable installs in CI, but this repo gitignores yarn.lock, so the install fails. Match the pattern used in react.yml. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

fix(ci): use yarn config set for supportedArchitectures

56a4bbb

YARN_SUPPORTED_ARCHITECTURES env var doesn't work as JSON in Yarn 3.4.1. Use yarn config set with --json flag to set each sub-key individually. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

joker23 force-pushed the skz/sdk-2170/ci-SBOM branch from 36b5ac5 to d73db95 Compare April 24, 2026 21:02

kinyoklion approved these changes Apr 27, 2026

View reviewed changes

joker23 changed the title ~~fix(ci): fix dependency-scan SBOM workflow to scan released packages~~ ci: fix dependency-scan SBOM workflow to scan released packages Apr 27, 2026

joker23 merged commit ba3dd2a into main Apr 27, 2026
45 checks passed

joker23 deleted the skz/sdk-2170/ci-SBOM branch April 27, 2026 19:44

Conversation

joker23 commented Apr 16, 2026 • edited by cursor Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Changes

Test plan

Uh oh!

github-actions Bot commented Apr 16, 2026

Uh oh!

github-actions Bot commented Apr 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Apr 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Apr 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

This comment was marked as resolved.

Uh oh!

devin-ai-integration Bot left a comment

Choose a reason for hiding this comment

✅ Devin Review: No Issues Found

Uh oh!

joker23 commented Apr 22, 2026

Uh oh!

cursor Bot left a comment

Choose a reason for hiding this comment

Uh oh!

This comment was marked as resolved.

Uh oh!

This comment was marked as resolved.

Uh oh!

joker23 commented Apr 22, 2026

Uh oh!

joker23 commented Apr 24, 2026

Uh oh!

cursor Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

joker23 commented Apr 16, 2026 •

edited by cursor Bot

Loading

github-actions Bot commented Apr 16, 2026 •

edited

Loading

github-actions Bot commented Apr 16, 2026 •

edited

Loading

github-actions Bot commented Apr 16, 2026 •

edited

Loading