[sbom+yarn] move back to yarn library

Author: corneliusludmann

pkg/leeway/build.go

@@ -1127,31 +1127,32 @@ func (p *Package) buildYarn(buildctx *buildContext, wd, result string) (bld *pac
 	}
 	var modifiedPackageJSON bool
 
-	var packageJSONFiles []interface{}
-	if rfs, ok := packageJSON["files"]; ok {
-		fs, ok := rfs.([]interface{})
-		if !ok {
-			return nil, xerrors.Errorf("invalid package.json: files section is not a list of strings")
-		}
-		packageJSONFiles = fs
-	}
-
-	if p.C.W.Provenance.Enabled {
-		packageJSONFiles = append(packageJSONFiles, provenanceBundleFilename)
-		packageJSON["files"] = packageJSONFiles
-		modifiedPackageJSON = true
-	}
-	if p.C.W.SBOM.Enabled {
-		packageJSONFiles = append(packageJSONFiles, sbomCycloneDXFilename)
-		packageJSONFiles = append(packageJSONFiles, sbomSPDXFilename)
-		packageJSONFiles = append(packageJSONFiles, sbomSyftFilename)
-		packageJSON["files"] = packageJSONFiles
-		modifiedPackageJSON = true
-	}
-
 	if cfg.Packaging == YarnLibrary {
 		// We can't modify the `yarn pack` generated tar file without runnign the risk of yarn blocking when attempting to unpack it again. Thus, we must include the pkgYarnLock in the npm
 		// package we're building. To this end, we modify the package.json of the source package.
+		var packageJSONFiles []interface{}
+		
+		if rfs, ok := packageJSON["files"]; ok {
+			fs, ok := rfs.([]interface{})
+			if !ok {
+				return nil, xerrors.Errorf("invalid package.json: files section is not a list of strings")
+			}
+			packageJSONFiles = fs
+		}
+
+		if p.C.W.Provenance.Enabled {
+			packageJSONFiles = append(packageJSONFiles, provenanceBundleFilename)
+			packageJSON["files"] = packageJSONFiles
+			modifiedPackageJSON = true
+		}
+		if p.C.W.SBOM.Enabled {
+			packageJSONFiles = append(packageJSONFiles, sbomCycloneDXFilename)
+			packageJSONFiles = append(packageJSONFiles, sbomSPDXFilename)
+			packageJSONFiles = append(packageJSONFiles, sbomSyftFilename)
+			packageJSON["files"] = packageJSONFiles
+			modifiedPackageJSON = true
+		}
+
 		packageJSONFiles = append(packageJSONFiles, pkgYarnLock)
 		packageJSON["files"] = packageJSONFiles
 		modifiedPackageJSON = true