fix(npm): Introduce installation for cyclone-node-npm in another folder and fallback to cyclonedx/bom to help users generate BOM

[ashlymat]

• Install cyclonedx-npm module in a separate (to avoid extraneous errors ) and try to generate BOM as this is the recommended and generates a more detailed BOM

• Lots of users are still facing issues , this is mostly due to how cyclonedx-node-npm module relies on npm ls command internally, which is used internally to generate a a dependency tree of infinite depth. For some users with special settings, there are hiccups on how this command works and hence BOM generation is affected. More details can be found here and here.

• Hence ,we use cyclonedx/bom as a fallback to generate BOM - to facilitate BOM generation when new module throws errors.

• To avoid publishing this new folder and packages , an entry to npmignore was added

[ashlymat]

/it-go

Significant change in code since last review, will be helpful to look again

[jliempt]

I now see in the logs that with the publish flag set to true, it finds an additional package.json and publishes that:

info  npmExecuteScripts - Discovered package.json file bomFolder/package.json
info  npmExecuteScripts - Discovered package.json file package.json
info  npmExecuteScripts - triggering publish for bomFolder/package.json

I'm not sure how that package.json is created in bomFolder, but I feel it should be excluded when publishing.

Apart from that, it works well, having tested it with a few images.

[ashlymat]

I now see in the logs that with the publish flag set to true, it finds an additional package.json and publishes that:

info  npmExecuteScripts - Discovered package.json file bomFolder/package.json
info  npmExecuteScripts - Discovered package.json file package.json
info  npmExecuteScripts - triggering publish for bomFolder/package.json

I'm not sure how that package.json is created in bomFolder, but I feel it should be excluded when publishing.

Apart from that, it works well, having tested it with a few images.

Good catch.
I have introduced back "--no-save" option, which seems to solve this issue
but still see the published tarball notices this new folder and installed package and publishes it as a much bigger package .
To solve this we needed to add this new folder to .npmignore in publish.go

[ashlymat]

/it-go

[ashlymat]

@jliempt thanks for approval, will merge on Monday

[ashlymat]

/it-go

[ashlymat]

/it-go

[ashlymat]

/it-go

[ashlymat]

/it-go

[sonarqubecloud]

Kudos, SonarCloud Quality Gate passed!   

0 Bugs
0 Vulnerabilities
0 Security Hotspots
0 Code Smells

No Coverage information
No Duplication information

[ashlymat]

/it-go