dep check

.github/workflows/dep.yml

@@ -0,0 +1,34 @@
+name: Dependency Tracking
+
+on:
+  push:
+    branches:
+      - main
+
+jobs:
+  sbom:
+    name: SBOM Generation and Upload
+    runs-on: ubuntu-latest
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v3
+
+    - name: Setup PNPM and Node
+      uses: pnpm/setup@v3
+      with:
+        runtime: node@24
+
+    - name: Generate SBOM
+      run: pnpm sbom --sbom-format cyclonedx --sbom-type application --out sbom.cyclonedx.json
+
+    - name: Upload SBOM
+      uses: DependencyTrack/gh-upload-sbom@v4
+      with:
+        protocol: ${{ vars.DT_API_PROTOCOL }}
+        server-hostname: ${{ vars.DT_API_HOSTNAME }}
+        port: ${{ vars.DT_API_PORT }}
+        api-key: ${{ secrets.DT_API_KEY }}
+        project-name: 'Liam Portfolio'
+        project-version: 'main'
+        auto-create: true
+        bom-filename: 'sbom.cyclonedx.json'