DependencyTrack / DependencyTrack/gh-upload-sbom
Improve output in error cases
- Dominant language
- JavaScript
- Stars
- 66
- Forks
- 33
- Avg merge
- 7h 18m
- Merged PRs (30d)
- 3
Description
Right now I occassionally get the following error:
```
> Run DependencyTrack/gh-upload-sbom@v3
with:
serverHostname: xxx.xxx.xxx.xxx
port: 8443
apiKey: ***
projectName: xxx
projectVersion: develop
bomFilename: sbom.json
parent: xxx-xxx-xxx-xxx
autoCreate: true
protocol: https
env:
NODE_TLS_REJECT_UNAUTHORIZED: 0
Reading BOM: sbom.json...
Uploading to Dependency-Track server xxx.xxx.xxx.xxx...
(node:7862) Warning: Setting the NODE_TLS_REJECT_UNAUTHORIZED environment variable to '0' makes TLS connections and HTTPS requests insecure by disabling certificate verification.
(Use `node --trace-warnings ...` to show where the warning was created)
Error: fetch failed
```
Sadly the `Error: fetch failed` is not really helping to find out what's going wrong. Re-running the job usually fixes it. It's not a firewall issue, since we had that before and that showed as a timeout instead of fetching failing.
This is because `core.setFailed(error.message);` is only logging the `message` part of `error` (which isn't useful). Either log the full `error` or at least include the `error.cause`.
Contributor guide
No contributing guide indexed for this repository
Research direction
Start at the action code path that calls core.setFailed(error.message) after the BOM upload fails. Reproduce or inspect the logged failure and compare the output with the full error or its cause; done when upload failures expose useful diagnostic details instead of only "fetch failed".
Written by the indexing model from the issue text.
Assessment
- Tech stack
- github-actions, javascript
- Domain
- ci-cd
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100