name: Dependency Tracking

on:
  push:
    branches:
      - feat/dep-setup

jobs:
  sbom:
    name: SBOM Generation and Upload
    runs-on: ubuntu-latest
    steps:
    - name: Checkout repository
      uses: actions/checkout@v3

    - name: Setup PNPM and Node
      uses: pnpm/setup@v3
      with:
        runtime: node@20

    - name: Install dependencies
      run: pnpm install --frozen-lockfile

    - name: Generate SBOM
      run: pnpm sbom --sbom-format cyclonedx --out sbom.cyclonedx.json

    - name: Upload SBOM
      uses: DependencyTrack/gh-upload-sbom@v4
      with:
        protocol: ${{ vars.DT_API_PROTOCOL }}
        server-hostname: ${{ vars.DT_API_HOSTNAME }}
        port: ${{ vars.DT_API_PORT }}
        api-key: ${{ secrets.DT_API_KEY }}
        project-name: 'Code Snippets'
        project-version: 'main'
        bom-file: 'sbom.cyclonedx.json'