save return code

Author: mcasimir

.evergreen.yml

@@ -5843,14 +5843,24 @@ functions:
           npm run update-third-party-notices
 
           # generate vulnerability report
+          set +e
           npm run generate-vulnerability-report
+          return_code=$?
+          set -e
 
           # if on main and not triggered by a tag, also create a ticket for each vulnerability found
           if [[ "${requester}" == "commit" ]]; then
             export JIRA_BASE_URL="https://jira.mongodb.org"
             export JIRA_PROJECT="MONGOSH"
             export JIRA_VULNERABILITY_BUILD_INFO="- [Evergreen task|$EVERGREEN_TASK_URL]"
             npm run create-vulnerability-tickets
+          else
+            cat .sbom/vulnerability-report.md
+          fi
+
+          # Fails if the report failed and is not a patch, including during releases:
+          if [[ "${is_patch}" != "true" ]]; then
+            exit $return_code
           fi
 
     - command: s3.put

.evergreen/evergreen.yml.in

@@ -544,14 +544,24 @@ functions:
           npm run update-third-party-notices
 
           # generate vulnerability report
+          set +e
           npm run generate-vulnerability-report
+          return_code=$?
+          set -e
 
           # if on main and not triggered by a tag, also create a ticket for each vulnerability found
           if [[ "${requester}" == "commit" ]]; then
             export JIRA_BASE_URL="https://jira.mongodb.org"
             export JIRA_PROJECT="MONGOSH"
             export JIRA_VULNERABILITY_BUILD_INFO="- [Evergreen task|$EVERGREEN_TASK_URL]"
             npm run create-vulnerability-tickets
+          else
+            cat .sbom/vulnerability-report.md
+          fi
+
+          # Fails if the report failed and is not a patch, including during releases:
+          if [[ "${is_patch}" != "true" ]]; then
+            exit $return_code
           fi
 
     - command: s3.put

package.json

@@ -63,8 +63,8 @@
     "scan-node-js": "mongodb-sbom-tools scan-node-js --version=$NODE_JS_VERSION > .sbom/node-js-vuln.json",
     "snyk-test": "node scripts/snyk-test.js",
     "pregenerate-vulnerability-report": "npm run webpack-build -w packages/cli-repl && npm run snyk-test && npm run scan-node-js && npm run write-node-js-dep",
-    "generate-vulnerability-report": "mongodb-sbom-tools generate-vulnerability-report --snyk-reports=.sbom/snyk-test-result.json,.sbom/node-js-vuln.json --dependencies=.sbom/dependencies.json,.sbom/node-js-dep.json > .sbom/vulnerability-report.md",
-    "create-vulnerability-tickets": "mongodb-sbom-tools generate-vulnerability-report --snyk-reports=.sbom/snyk-test-result.json,.sbom/node-js-vuln.json --dependencies=.sbom/dependencies.json,.sbom/node-js-dep.json --fail-on=high --create-jira-issues"
+    "generate-vulnerability-report": "mongodb-sbom-tools generate-vulnerability-report --snyk-reports=.sbom/snyk-test-result.json,.sbom/node-js-vuln.json --dependencies=.sbom/dependencies.json,.sbom/node-js-dep.json --fail-on=high > .sbom/vulnerability-report.md",
+    "create-vulnerability-tickets": "mongodb-sbom-tools generate-vulnerability-report --snyk-reports=.sbom/snyk-test-result.json,.sbom/node-js-vuln.json --dependencies=.sbom/dependencies.json,.sbom/node-js-dep.json --create-jira-issues"
   },
   "config": {
     "unsafe-perm": true