dep check

.github/workflows/dep.yml

@@ -0,0 +1,34 @@
+name: Dependency Tracking
+
+on:
+  push:
+    branches:
+      - main
+
+jobs:
+  sbom:
+    name: SBOM Generation and Upload
+    runs-on: ubuntu-latest
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v3
+
+    - name: Setup PNPM and Node
+      uses: pnpm/setup@v3
+      with:
+        runtime: node@24
+
+    - name: Generate SBOM
+      run: pnpm sbom --sbom-format cyclonedx --sbom-type application --out sbom.cyclonedx.json
+
+    - name: Upload SBOM
+      uses: DependencyTrack/gh-upload-sbom@v4
+      with:
+        protocol: ${{ vars.DT_API_PROTOCOL }}
+        server-hostname: ${{ vars.DT_API_HOSTNAME }}
+        port: ${{ vars.DT_API_PORT }}
+        api-key: ${{ secrets.DT_API_KEY }}
+        project-name: 'Liam Portfolio'
+        project-version: 'main'
+        auto-create: true
+        bom-filename: 'sbom.cyclonedx.json'

package.json

@@ -38,11 +38,5 @@
     "tailwindcss": "^4",
     "typescript": "^5"
   },
-  "packageManager": "pnpm@10.24.0+sha512.01ff8ae71b4419903b65c60fb2dc9d34cf8bb6e06d03bde112ef38f7a34d6904c424ba66bea5cdcf12890230bf39f9580473140ed9c946fef328b6e5238a345a",
-  "pnpm": {
-    "overrides": {
-      "@types/react": "19.2.8",
-      "@types/react-dom": "19.2.3"
-    }
-  }
+  "packageManager": "pnpm@12.8.1+sha512.f64ba907507f5ceafe06c8d38e6052d0179444580ec1279ddd5bfc11cb48aa8a2644b66598e07e761da84872a9fc57d5f902b87fa49d024198d558612aabbe45"
 }

pnpm-workspace.yaml

@@ -1,5 +1,5 @@
-onlyBuiltDependencies:
-  - '@tailwindcss/oxide'
-  - esbuild
-  - sharp
-  - unrs-resolver
+allowBuilds:
+  '@tailwindcss/oxide': false
+  esbuild: false
+  sharp: false
+  unrs-resolver: false