[ruby] cdxgen fails when gem lock is missing (using --fail-on-error)

[sebbalv]

When using the --fail-on-error flag, should it really fail the job when the gem lock file is missing? I think it should be enough with just a warning, since there is no problem creating the bom, just that it is imprecise. A bom is correctly generated with the deps from the gemspec file when the failOnError flag is not used, so it should probably not completely fail with the flag on.
My suggestion would be to remove line 6178 here:

cdxgen/lib/cli/index.js

Lines 6172 to 6179 in 91db7fc

	// Parsing .gemspec files would help us get more metadata such as description, authors, licenses etc
	if (gemspecFiles.length) {
	if (!gemLockFiles.length && !hasAnyProjectType(["oci"], options, false)) {
	console.log(
	"SBOM generation using only gemspec files is imprecise and results in an inaccurate dependency tree.",
	);
	options.failOnError && process.exit(1);
	}

[prabhu]

+1 from me. Will see what others think.

[sebbalv]

Hi again, any news on this?