component-detection submit-snapshot fails with HTTP 500 from Dependency Submission API

Summary

The advanced-security/component-detection-dependency-submission-action step is failing on PR builds while submitting the dependency snapshot to GitHub's Dependency Submission API. The scan itself completes; only the upload step errors out.

Observed error

Error: Server Error
Error: HttpError: Server Error
    at .../node_modules/@octokit/request/dist-node/index.js:125:1
...
Error: Failed to submit snapshot: HttpError: Server Error
    at L (.../@github/dependency-submission-toolkit/dist/index.js:2:1)

The action used: advanced-security/component-detection-dependency-submission-action@b876b8cc341a53970394b33ea0ca4e86c25542de
Args: detectorArgs: UvLock=EnableIfDefaultOff

Secondary (non-fatal) observation

The same log shows the npm lockfile detector skipping the root package-lock.json:

[INF] Could not parse JSON from /home/runner/work/hve-core/hve-core/package-lock.json file.
System.Text.Json.JsonException: The JSON value could not be converted to System.String.
  Path: $.license | LineNumber: 5
---> Cannot get the value of a token type 'StartArray' as a string.

The root package-lock.json has "license" as an array (valid SPDX form) but Microsoft's NpmLockfile3Detector expects a string. This means the root npm graph is excluded from the snapshot — separate from the 5xx, but worth noting.

Likely causes for the 5xx

1. Transient GitHub Dependency Submission API outage (most common).
2. Snapshot payload too large — the produced JSON includes many transitive packages and the API can return 500 on oversized payloads.
3. Workflow permissions: block is missing contents: write (usually returns 403, but worth verifying).

Suggested investigation

• Re-run the failed job and confirm whether the error is reproducible.
• Inspect the workflow file invoking the action and confirm permissions: contents: write is set on the job.
• Compare snapshot size against GitHub's documented limits.
• Consider scoping --SourceDirectory or excluding node_modules / vendored lockfiles to reduce payload size.
• Decide whether to fix the root package-lock.json license-array detector skip (likely requires upstream patch in component-detection).

Acceptance criteria

• Root cause identified (transient vs payload vs permissions vs other).
• Workflow consistently submits the snapshot on PR builds, or the step is reconfigured / replaced.
• Optional: root package-lock.json is included in the snapshot (npm detector parses it).

Context

First observed on PR #1545 build run.