diff --git a/pkg/npm/bom.go b/pkg/npm/bom.go index cb19f3c93a..316b29781b 100644 --- a/pkg/npm/bom.go +++ b/pkg/npm/bom.go @@ -143,8 +143,8 @@ func (exec *Execute) generatePnpmBOMFiles(packageJSONFiles []string, cliPath str // createNpmBOM generates a BOM for npm/yarn projects using cyclonedx-npm func (exec *Execute) createNpmBOM(packageJSONFiles []string) error { // Primary attempt with cyclonedx-npm - cycloneDxNpmInstallParams := []string{"install", "--no-save", cycloneDxNpmPackageVersion, "--prefix", tmpInstallFolder} - cycloneDxNpmRunParams := []string{"--output-format", "XML", "--spec-version", CycloneDxSchemaVersion, "--omit", "dev", "--output-file"} + cycloneDxNpmInstallParams := []string{"install", "--no-save", cycloneDxNpmPackageVersion, "--prefix", tmpInstallFolder, "--no-workspaces"} + cycloneDxNpmRunParams := []string{"--output-format", "XML", "--spec-version", CycloneDxSchemaVersion, "--omit", "dev", "--ignore-npm-errors", "--output-file"} err := exec.createBOMWithParams(cycloneDxNpmInstallParams, cycloneDxNpmRunParams, packageJSONFiles) if err != nil { diff --git a/pkg/npm/bom_test.go b/pkg/npm/bom_test.go index 70ebe47b38..c1918ec6e6 100644 --- a/pkg/npm/bom_test.go +++ b/pkg/npm/bom_test.go @@ -30,7 +30,7 @@ func TestBom(t *testing.T) { Options: options, } err := exec.CreateBOM([]string{"package.json", filepath.Join("src", "package.json")}) - cycloneDxNpmInstallParams := []string{"install", "--no-save", "@cyclonedx/cyclonedx-npm@2.1.0", "--prefix", "./tmp"} + cycloneDxNpmInstallParams := []string{"install", "--no-save", "@cyclonedx/cyclonedx-npm@2.1.0", "--prefix", "./tmp", "--no-workspaces"} cycloneDxNpmRunParams := []string{ "--output-format", "XML", @@ -38,6 +38,7 @@ func TestBom(t *testing.T) { CycloneDxSchemaVersion, "--omit", "dev", + "--ignore-npm-errors", "--output-file", } @@ -56,7 +57,7 @@ func TestBom(t *testing.T) { utils.AddFile("package-lock.json", []byte("{}")) utils.AddFile(filepath.Join("src", "package.json"), []byte("{\"scripts\": { \"ci-lint\": \"exit 0\" } }")) utils.AddFile(filepath.Join("src", "package-lock.json"), []byte("{}")) - utils.execRunner.ShouldFailOnCommand = map[string]error{"npm install --no-save @cyclonedx/cyclonedx-npm@2.1.0 --prefix ./tmp": fmt.Errorf("failed to install CycloneDX BOM")} + utils.execRunner.ShouldFailOnCommand = map[string]error{"npm install --no-save @cyclonedx/cyclonedx-npm@2.1.0 --prefix ./tmp --no-workspaces": fmt.Errorf("failed to install CycloneDX BOM")} options := ExecutorOptions{} options.DefaultNpmRegistry = "foo.bar" @@ -86,6 +87,7 @@ func TestBom(t *testing.T) { "--output-format", "XML", "--spec-version", CycloneDxSchemaVersion, "--omit", "dev", + "--ignore-npm-errors", "--output-file", "bom-npm.xml", "package.json", }, " ")