jfrog / jfrog/setup-jfrog-cli

Upgrading to jfrog-cli 4.5.8 from 4.5.6 broke `jf audit` with workspaces

Open
#274 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

bug
Dominant language
TypeScript
Stars
266
Forks
110
Avg merge
3d 15h
Merged PRs (30d)
3

Description

Describe the bug

When running a previously working pipeline that called jf audit after upgrading to v4.5.8 I encountered ENOWORKSPACES errors attempting to validate my projects dependencies.

I believe this can be remedied by specifying the folder to scan, but this was not previously required and represents a breaking change.

Current behavior

From Github Actions

[Info] Performing scans on 17 targets:
[
  {
    "target": "/home/runner/work/REDACTED",
    "technology": "npm"
  },
  {
    "target": "/home/runner/work/REDACTED",
    "technology": "npm"
  },
// ... and many more
]
[Info] Not entitled for JAS, skipping advance security scans...
[Info] Calculating npm dependencies...
npm error code ENOWORKSPACES
npm error This command does not support workspaces.
npm error A complete log of this run can be found in: /home/runner/.npm/_logs/2025-05-12T18_56_40_031Z-debug-0.log
// ... and many more
Reproduction steps

run jf audit in a project that uses workspaces with jfcli v4.5.8

Expected behavior

The audit completes

Setup JFrog CLI version

4.5.8

JFrog CLI version

4.5.8

Workflow operating system type and version

Linux

JFrog Artifactory version (if relevant)

No response

JFrog Xray version (if relevant)

No response

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reproducing jf audit with JFrog CLI 4.5.8 in an npm workspace project running through GitHub Actions, then compare the behavior with 4.5.6. The issue is done when the audit completes without ENOWORKSPACES errors while scanning the workspace dependencies.

Written by the indexing model from the issue text.

Assessment

Tech stack
github-actions
Domain
ci-cd, security
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.