.github/workflows/dep.yml

@@ -0,0 +1,67 @@
+name: Dependency Tracking
+
+on:
+  push:
+    branches:
+      - main
+
+jobs:
+  sbom:
+    name: SBOM Generation and Upload
+    runs-on: ubuntu-latest
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v4
+
+    - name: Setup PNPM and Node
+      uses: pnpm/setup@v3
+      with:
+        working-directory: packages/frontend
+        runtime: node@22
+
+    - name: Setup .NET
+      uses: actions/setup-dotnet@v4
+      with:
+        dotnet-version: '10.0.x'
+
+    - name: Install CycloneDX .NET tool
+      run: |
+        dotnet tool install --global CycloneDX
+        echo "$HOME/.dotnet/tools" >> "$GITHUB_PATH"
+
+    - name: Generate backend SBOM
+      run: dotnet-CycloneDX packages/backend/YaleAccess.sln -o . -fn sbom.backend.cyclonedx.json
+
+    - name: Generate frontend SBOM
+      working-directory: packages/frontend
+      run: |
+        pnpm install --frozen-lockfile
+        pnpm sbom --sbom-format cyclonedx --sbom-type application --out ../../sbom.frontend.cyclonedx.json
+
+    - name: Upload backend SBOM
+      uses: DependencyTrack/gh-upload-sbom@v4
+      with:
+        protocol: ${{ vars.DT_API_PROTOCOL }}
+        server-hostname: ${{ vars.DT_API_HOSTNAME }}
+        port: ${{ vars.DT_API_PORT }}
+        api-key: ${{ secrets.DT_API_KEY }}
+        project-name: 'YaleAccess Backend'
+        project-version: 'main'
+        parent-name: 'YaleAccess'
+        parent-version: 'main'
+        auto-create: true
+        bom-filename: 'sbom.backend.cyclonedx.json'
+
+    - name: Upload frontend SBOM
+      uses: DependencyTrack/gh-upload-sbom@v4
+      with:
+        protocol: ${{ vars.DT_API_PROTOCOL }}
+        server-hostname: ${{ vars.DT_API_HOSTNAME }}
+        port: ${{ vars.DT_API_PORT }}
+        api-key: ${{ secrets.DT_API_KEY }}
+        project-name: 'YaleAccess Frontend'
+        project-version: 'main'
+        parent-name: 'YaleAccess'
+        parent-version: 'main'
+        auto-create: true
+        bom-filename: 'sbom.frontend.cyclonedx.json'

packages/frontend/Dockerfile

@@ -1,10 +1,10 @@
 FROM node:lts-alpine as build
 WORKDIR /src
 COPY ["package.json", "."]
-COPY ["yarn.lock", "."]
-RUN yarn install
+COPY ["pnpm-lock.yaml", "pnpm-workspace.yaml", "."]
+RUN pnpm install --frozen-lockfile
 COPY . .
-RUN yarn build
+RUN pnpm build
 
 FROM node:lts-alpine as production
 COPY --from=build /src/.output /app

packages/frontend/package.json

@@ -9,13 +9,13 @@
     "preview": "nuxt preview",
     "postinstall": "nuxt prepare"
   },
-  "devDependencies": {
+  "dependencies": {
     "@nuxt/devtools": "latest",
     "@nuxtjs/tailwindcss": "^6.11.3",
     "nuxt": "^3.9.1",
     "vue": "^3.4.10",
     "vue-router": "^4.2.5"
   },
-  "dependencies": {},
-  "packageManager": "yarn@1.22.22+sha1.ac34549e6aa8e7ead463a7407e1c7390f61a6610"
+  "devDependencies": {},
+  "packageManager": "pnpm@12.6.0+sha512.3ef68f951cb111ac204b4a5a16f0b2ddf0da56a96e0413e81d855d9f0b55ef926714709028e1cd00c405c2c5fb7b9e8ec4dc46777c805d0373c2f2ff00fd20ec"
 }

packages/frontend/pnpm-workspace.yaml

@@ -0,0 +1,2 @@
+allowBuilds:
+  esbuild: true