34220838138
84%

Ran 08 Sep 2026 11:31AM UTC

Jobs 0

Files 0

Run time –

Badge

Embed ▾

pending completion

Build # 34220838138

Build Type

push

github

Committed by

web-flow

Commit Message

fix: resolve third-party-notices generation paths and refresh license config (#1500)

Fixes the `update-third-party-notices` step failing with `ENOENT: open
'licenses.json'`.

**Root cause**: `create-dependency-sbom-lists` and
`update-third-party-notices` run via `pnpm --filter
@mongodb-js/mcp-scripts`, which forces the working directory to
`packages/scripts`. Their relative paths (`.sbom/`,
`--config=licenses.json`, `> THIRD_PARTY_NOTICES.md`) are all relative
to the **repo root**, so:
- the SBOM was written to `packages/scripts/.sbom/` instead of the root
`.sbom/` (which `dependency-health.yml` reads),
- `licenses.json` (repo root) was not found → `ENOENT`.

**Fix**:
- `packages/scripts/src/sbomReport/dependencies.ts`: write `.sbom/` to
the monorepo root via `import.meta.dirname`.
- `package.json` → `update-third-party-notices`: run
`mongodb-sbom-tools` from the repo root (drop the `--filter exec` cwd
switch). `mongodb-sbom-tools` is a root devDependency.
- `licenses.json`: refresh the ignore/allow config for the current
lockfile (fix stale `hadron-document`/`hadron-type-checker` versions;
add scoped platform-binary orgs; allow `MPL-2.0`/`CC0-1.0`). This
resolves the licence-validation failures that blocked the step.

Verified end-to-end: `create-dependency-sbom-lists` +
`update-third-party-notices` complete successfully and regenerate
`THIRD_PARTY_NOTICES.md`.

Coverage Stats

Source Files on build 34220838138

Detailed source file information is not available for this build.

mongodb-js / mongodb-mcp-server / 34220838138
84%

README BADGES
x

Markdown

Textile

RDoc

HTML

Rst

Source Files on build 34220838138

mongodb-js / mongodb-mcp-server / 34220838138 84%

README BADGES x

Markdown

Textile

RDoc

HTML

Rst

Source Files on build 34220838138

mongodb-js / mongodb-mcp-server / 34220838138
84%

README BADGES
x