Force package lock creation for stubborn projects with .npmrc #718

	name: Test BOM Snapshots

	on:
	workflow_dispatch:
	pull_request:
	branches:
	- master
	push:
	branches:
	- master


	concurrency:
	group: "${{ github.workflow }}-${{ github.head_ref \|\| github.run_id }}"
	cancel-in-progress: true


	jobs:

	test_non_dotnet:
	runs-on: ["snapshot-test"]
	steps:

	- uses: actions/checkout@v4

	- name: Set up pnpm
	uses: pnpm/action-setup@v4

	- name: cdxgen, custom-json-diff installs
	shell: bash
	env:
	SHELL: bash
	run: \|
	rm -rf original_snapshots new_snapshots src_repos
	cdxgen_tarball=$(pnpm pack \| tail -1)
	npm install -g "$cdxgen_tarball"
	git clone https://github.com/appthreat/cdxgen-samples.git original_snapshots
	python3.12 -m venv .venv
	source .venv/bin/activate && pip install -r test/diff/requirements.txt

	- name: Generate scripts
	run: \|
	source .venv/bin/activate
	python test/diff/generate.py

	- name: Upload shell scripts generated as artifact
	uses: actions/upload-artifact@v4
	with:
	name: scripts
	path: new_snapshots/*.sh

	- name: Run scripts
	env:
	PREFER_MAVEN_DEPS_TREE: false
	run: \|
	bash new_snapshots/cdxgen_commands.sh

	- name: Upload cdxgen boms
	uses: actions/upload-artifact@v4
	with:
	name: cdxgen_boms
	path: \|
	new_snapshots

	- name: Test BOMs
	run: \|
	source .venv/bin/activate
	python test/diff/diff_tests.py --migrate-legacy
	if test -f new_snapshots/diffs.json; then
	echo "status=FAILED" >> "$GITHUB_ENV"
	fi

	- name: Upload diff
	if: ${{ env.status == 'FAILED' }}
	uses: actions/upload-artifact@v4
	with:
	name: diffs
	path: \|
	new_snapshots/diffs.json
	new_snapshots/*.html

	- name: Exit with error
	if: ${{ env.status == 'FAILED' }}
	run: exit 1

Provide feedback