[CI] ci job `Test Build For Component katib-ui` is flaky

[mahdikhashan]

What happened?

ERROR: failed to solve: process "/bin/sh -c npm config set fetch-retry-mintimeout 20000 && npm config set fetch-retry-maxtimeout 120000 && npm config get registry && npm config set registry https://registry.npmjs.org/ && npm config get https-proxy && npm config rm https-proxy && npm ci" did not complete successfully: exit code: 1
Error: buildx failed with: ERROR: failed to solve: process "/bin/sh -c npm config set fetch-retry-mintimeout 20000 && npm config set fetch-retry-maxtimeout 120000 && npm config get registry && npm config set registry https://registry.npmjs.org/ && npm config get https-proxy && npm config rm https-proxy && npm ci" did not complete successfully: exit code: 1

ref: https://github.com/kubeflow/katib/actions/runs/12830311211/job/36110037074?pr=2496

What did you expect to happen?

the ci to pass this step

Environment

Kubernetes version:

$ kubectl version

Katib controller version:

$ kubectl get pods -n kubeflow -l katib.kubeflow.org/component=controller -o jsonpath="{.items[*].spec.containers[*].image}"

Katib Python SDK version:

$ pip show kubeflow-katib

Impacted by this bug?

Give it a 👍 We prioritize the issues with most 👍

[andreyvelich]

Thanks for creating this @mahdikhashan!
/good-first-issue
/remove-label lifecycle/needs-triage

[google-oss-prow]

@andreyvelich:
This request has been marked as suitable for new contributors.

Please ensure the request meets the requirements listed here.

If this request no longer meets these requirements, the label can be removed
by commenting with the /remove-good-first-issue command.

In response to this:

Thanks for creating this @mahdikhashan!
/good-first-issue
/remove-label lifecycle/needs-triage

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[mahdikhashan]

I have multiple in progress issues, however, this one is interesting, is it fine if I keep working on it myself? @andreyvelich

[andreyvelich]

Absolutely, thank you for your time @mahdikhashan!
/assign @mahdikhashan

[mahdikhashan]

it could be that npm audit is causing the ci to fail:

# npm audit report

@angular/core  <10.2.5
Severity: moderate
Cross site scripting in Angular - https://github.com/advisories/GHSA-c75v-2vq8-878f
fix available via `npm audit fix --force`
Will install codelyzer@0.0.28, which is a breaking change
node_modules/codelyzer/node_modules/@angular/core
  codelyzer  >=1.0.0-beta.0
  Depends on vulnerable versions of @angular/core
  node_modules/codelyzer

cookie  <0.7.0
cookie accepts cookie name, path, and domain with out of bounds characters - https://github.com/advisories/GHSA-pxg6-pf52-xh8x
fix available via `npm audit fix`
node_modules/cookie
  engine.io  1.8.0 - 6.6.1
  Depends on vulnerable versions of cookie
  node_modules/engine.io
    socket.io  1.6.0 - 4.7.5
    Depends on vulnerable versions of engine.io
    node_modules/socket.io

cross-spawn  7.0.0 - 7.0.4
Severity: high
Regular Expression Denial of Service (ReDoS) in cross-spawn - https://github.com/advisories/GHSA-3xgq-45jj-v275
fix available via `npm audit fix`
node_modules/cross-spawn

http-proxy-middleware  <2.0.7
Severity: high
Denial of service in http-proxy-middleware - https://github.com/advisories/GHSA-c7qv-q95q-8v27
fix available via `npm audit fix`
node_modules/http-proxy-middleware

jsonpath-plus  <10.0.7
Severity: critical
JSONPath Plus Remote Code Execution (RCE) Vulnerability - https://github.com/advisories/GHSA-pppg-cpfq-h7wr
fix available via `npm audit fix --force`
Will install @kubernetes/client-node@1.0.0, which is a breaking change
node_modules/jsonpath-plus
  @kubernetes/client-node  <=1.0.0-rc7
  Depends on vulnerable versions of jsonpath-plus
  Depends on vulnerable versions of request
  node_modules/@kubernetes/client-node

micromatch  <4.0.8
Severity: moderate
Regular Expression Denial of Service (ReDoS) in micromatch - https://github.com/advisories/GHSA-952p-6rrq-rcjv
fix available via `npm audit fix`
node_modules/micromatch

nanoid  <3.3.8
Severity: moderate
Predictable results in nanoid generation when given non-integer values - https://github.com/advisories/GHSA-mwcw-c2x4-8c55
fix available via `npm audit fix`
node_modules/nanoid

request  *
Severity: moderate
Server-Side Request Forgery in Request - https://github.com/advisories/GHSA-p8p7-x288-28g6
Depends on vulnerable versions of tough-cookie
fix available via `npm audit fix --force`
Will install @kubernetes/client-node@1.0.0, which is a breaking change
node_modules/request

tough-cookie  <4.1.3
Severity: moderate
tough-cookie Prototype Pollution vulnerability - https://github.com/advisories/GHSA-72xf-g2v4-qvf3
fix available via `npm audit fix --force`
Will install @kubernetes/client-node@1.0.0, which is a breaking change
node_modules/request/node_modules/tough-cookie

webpack  5.0.0-alpha.0 - 5.93.0
Severity: moderate
Webpack's AutoPublicPathRuntimeModule has a DOM Clobbering Gadget that leads to XSS - https://github.com/advisories/GHSA-4vvj-4cpr-p986
fix available via `npm audit fix --force`
Will install @angular-devkit/build-angular@19.1.5, which is a breaking change
node_modules/webpack
  @angular-devkit/build-angular  <=16.2.14 || 17.0.0-next.0 - 17.3.8 || 18.0.0-next.0 - 18.2.1 || 19.0.0-next.0 - 19.0.0-rc.3
  Depends on vulnerable versions of webpack
  Depends on vulnerable versions of webpack-dev-middleware
  node_modules/@angular-devkit/build-angular

webpack-dev-middleware  <=5.3.3
Severity: high
Path traversal in webpack-dev-middleware - https://github.com/advisories/GHSA-wr3j-pwj9-hqq6
fix available via `npm audit fix --force`
Will install @angular-devkit/build-angular@19.1.5, which is a breaking change
node_modules/webpack-dev-middleware

16 vulnerabilities (3 low, 7 moderate, 4 high, 2 critical)

To address issues that do not require attention, run:
  npm audit fix

To address all issues (including breaking changes), run:
  npm audit fix --force