fix(e2e): the sbom locator matched the name AND the purl

[rubenvdlinde]

The failure

quality / E2E Tests (Playwright) is red on development (job) — 26 passed, 1 failed, and it fails on retry too, so it is not flake.

Error: strict mode violation:
  getByTestId('sbom-component-table').getByText('lodash') resolved to 2 elements:
    1) <span>lodash</span>
    2) <span>pkg:npm/lodash@4.17.21</span>

The product is fine. Each component row renders the NAME and its purl, so a substring match on lodash resolves to two spans, and Playwright's strict mode fails the assertion rather than silently picking one. Adding the purl column is what turned a previously-unique string into an ambiguous one — this broke without either the component or the test being edited.

The second one, which never ran

await expect(table.getByText('express')).toBeVisible()   // line 195

Identical defect. It never surfaced because the lodash assertion failed first and masked it — fixing only the reported line would have shown this as the next failure. Verified against the fixtures rather than assumed:

fixture	components
cyclonedx-1.6-valid.json	lodash / pkg:npm/lodash@4.17.21, log4j-core, openssl
cyclonedx-1.5-valid.json	express / pkg:npm/express@4.19.2, vue

The fix, and why it is deliberately asymmetric

• Presence assertions get { exact: true } — they must be unambiguous or strict mode rejects them.
• The absence assertion keeps its substring match. For "is it gone", the looser match is the stronger claim: it also fails if the purl survives the replace. And toHaveCount tolerates multiple matches, so strict mode never applies there.

Both cases are commented in place so the asymmetry does not read as an oversight and get "tidied" later.

Verification

Parses clean (node --experimental-strip-types --check). The assertion change is exactly what Playwright's own error message recommends — it prints aka getByText('lodash', { exact: true }) as the disambiguation.

Found while auditing Playwright e2e state across all 18 core apps: 11 green on their development HEAD, stackiq the only genuine failure, the rest either pending or sitting on a version-bump commit whose parent is green.

[github-actions]

Quality Report — ConductionNL/stackiq @ 6ba4d65

Check	PHP	Vue	Security	License	Tests
lint	✅
phpcs	✅
phpmd	✅
psalm	✅
phpstan	✅
phpmetrics	✅
eslint		✅
stylelint		✅
build		✅
check-manifest		✅
check-vue-demi		✅
test-l10n		✅
format		✅
check-schema-l10n		✅
composer			✅	✅ 130/130
npm			✅	✅ 720/720
app:check-code	⏭️
info.xml	✅
REUSE	❌
PHPUnit					✅
Newman					⏭️
Playwright					✅
Hydra gates					✅

---

Quality workflow — 2026-08-24 19:07 UTC

Download the full PDF report from the workflow artifacts.