chore: make vuln report fail only after creating tickets

Author: mcasimir

.evergreen.yml

@@ -5842,8 +5842,8 @@ functions:
           rm THIRD_PARTY_NOTICES.md
           npm run update-third-party-notices
 
-          # generate vulnerability report: can only fail if is not a patch.
-          npm run generate-vulnerability-report || { [ "$EVERGREEN_IS_PATCH" == "true" ] && exit 0; } || exit 1
+          # generate vulnerability report
+          npm run generate-vulnerability-report
 
           # if on main and not triggered by a tag, also create a ticket for each vulnerability found
           if [[ "${requester}" == "commit" ]]; then

.evergreen/evergreen.yml.in

@@ -543,8 +543,8 @@ functions:
           rm THIRD_PARTY_NOTICES.md
           npm run update-third-party-notices
 
-          # generate vulnerability report: can only fail if is not a patch.
-          npm run generate-vulnerability-report || { [ "$EVERGREEN_IS_PATCH" == "true" ] && exit 0; } || exit 1
+          # generate vulnerability report
+          npm run generate-vulnerability-report
 
           # if on main and not triggered by a tag, also create a ticket for each vulnerability found
           if [[ "${requester}" == "commit" ]]; then

package.json

@@ -63,8 +63,8 @@
     "scan-node-js": "mongodb-sbom-tools scan-node-js --version=$NODE_JS_VERSION > .sbom/node-js-vuln.json",
     "snyk-test": "node scripts/snyk-test.js",
     "pregenerate-vulnerability-report": "npm run webpack-build -w packages/cli-repl && npm run snyk-test && npm run scan-node-js && npm run write-node-js-dep",
-    "generate-vulnerability-report": "mongodb-sbom-tools generate-vulnerability-report --snyk-reports=.sbom/snyk-test-result.json,.sbom/node-js-vuln.json --dependencies=.sbom/dependencies.json,.sbom/node-js-dep.json --fail-on=high > .sbom/vulnerability-report.md",
-    "create-vulnerability-tickets": "mongodb-sbom-tools generate-vulnerability-report --snyk-reports=.sbom/snyk-test-result.json,.sbom/node-js-vuln.json --dependencies=.sbom/dependencies.json,.sbom/node-js-dep.json --create-jira-issues"
+    "generate-vulnerability-report": "mongodb-sbom-tools generate-vulnerability-report --snyk-reports=.sbom/snyk-test-result.json,.sbom/node-js-vuln.json --dependencies=.sbom/dependencies.json,.sbom/node-js-dep.json > .sbom/vulnerability-report.md",
+    "create-vulnerability-tickets": "mongodb-sbom-tools generate-vulnerability-report --snyk-reports=.sbom/snyk-test-result.json,.sbom/node-js-vuln.json --dependencies=.sbom/dependencies.json,.sbom/node-js-dep.json --fail-on=high --create-jira-issues"
   },
   "config": {
     "unsafe-perm": true