CycloneDX "error generating BOM" in CI

By Daniel Zoghalchali·Latchkey

A CycloneDX generator (cyclonedx-npm, cyclonedx-py, cyclonedx-gomod) failed to produce the BOM because the lockfile or dependency graph it reads was missing, incomplete, or the tool ran before dependencies were installed.

What this error means

The generator exits non-zero with "error generating BOM", "unable to read package-lock.json", or "no lock file found", and no bom.xml/bom.json is written.

cyclonedx-npm --output-file bom.json
Error: generating BOM: no package-lock.json found; run "npm install" first

Common causes

The lockfile is missing or dependencies are not installed

CycloneDX reads the resolved dependency graph from a lockfile. Without package-lock.json, poetry.lock, or go.sum, it cannot enumerate components.

The generator ran from the wrong directory

Run outside the project root, the tool finds no manifest and aborts before writing a BOM.

How to fix it

Install dependencies before generating

1. Run the ecosystem install first so a complete lockfile exists.
2. Invoke the CycloneDX generator from the project root.
3. Confirm the BOM file exists and has components.

npm ci
npx @cyclonedx/cyclonedx-npm --output-format JSON --output-file bom.json

Point the generator at the manifest explicitly

Pass the path to the lockfile or module directory so the tool does not rely on the current working directory.

cyclonedx-py poetry --output-file bom.json -i ./pyproject.toml

How to prevent it

• Commit lockfiles and run the ecosystem install before SBOM generation.
• Invoke the generator from the project root or pass an explicit input path.
• Validate the BOM has components before publishing or attesting it.

Frequently asked questions

Related guides

References

• GitHub Actions documentation