DependencyTrack / DependencyTrack/gh-upload-sbom

Improve output in error cases

Open
#48 2 comments 5 reactions 0 assignees View on GitHub
Dominant language
JavaScript
Stars
66
Forks
33
Avg merge
7h 18m
Merged PRs (30d)
3

Description

Right now I occassionally get the following error:
```
> Run DependencyTrack/gh-upload-sbom@v3
with:
serverHostname: xxx.xxx.xxx.xxx
port: 8443
apiKey: ***
projectName: xxx
projectVersion: develop
bomFilename: sbom.json
parent: xxx-xxx-xxx-xxx
autoCreate: true
protocol: https
env:
NODE_TLS_REJECT_UNAUTHORIZED: 0
Reading BOM: sbom.json...
Uploading to Dependency-Track server xxx.xxx.xxx.xxx...
(node:7862) Warning: Setting the NODE_TLS_REJECT_UNAUTHORIZED environment variable to '0' makes TLS connections and HTTPS requests insecure by disabling certificate verification.
(Use `node --trace-warnings ...` to show where the warning was created)
Error: fetch failed
```

Sadly the `Error: fetch failed` is not really helping to find out what's going wrong. Re-running the job usually fixes it. It's not a firewall issue, since we had that before and that showed as a timeout instead of fetching failing.

This is because `core.setFailed(error.message);` is only logging the `message` part of `error` (which isn't useful). Either log the full `error` or at least include the `error.cause`.

Contributor guide

No contributing guide indexed for this repository

Research direction

Start at the action code path that calls core.setFailed(error.message) after the BOM upload fails. Reproduce or inspect the logged failure and compare the output with the full error or its cause; done when upload failures expose useful diagnostic details instead of only "fetch failed".

Written by the indexing model from the issue text.

Assessment

Tech stack
github-actions, javascript
Domain
ci-cd
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.