name: Dependency Tracking

on:
  push:
    branches:
      - main

jobs:
  sbom:
    name: SBOM Generation and Upload
    runs-on: ubuntu-latest
    steps:
    - name: Checkout repository
      uses: actions/checkout@v4

    - name: Setup PNPM and Node
      uses: pnpm/setup@v3
      with:
        working-directory: packages/frontend
        runtime: node@22

    - name: Setup .NET
      uses: actions/setup-dotnet@v4
      with:
        dotnet-version: '10.0.x'

    - name: Install CycloneDX .NET tool
      run: |
        dotnet tool install --global CycloneDX
        echo "$HOME/.dotnet/tools" >> "$GITHUB_PATH"

    - name: Generate backend SBOM
      run: dotnet-CycloneDX packages/backend/YaleAccess.sln -o . -fn sbom.backend.cyclonedx.json

    - name: Generate frontend SBOM
      working-directory: packages/frontend
      run: |
        pnpm install --frozen-lockfile
        pnpm sbom --sbom-format cyclonedx --sbom-type application --out ../../sbom.frontend.cyclonedx.json

    - name: Upload backend SBOM
      uses: DependencyTrack/gh-upload-sbom@v4
      with:
        protocol: ${{ vars.DT_API_PROTOCOL }}
        server-hostname: ${{ vars.DT_API_HOSTNAME }}
        port: ${{ vars.DT_API_PORT }}
        api-key: ${{ secrets.DT_API_KEY }}
        project-name: 'YaleAccess Backend'
        project-version: 'main'
        parent-name: 'YaleAccess'
        parent-version: 'main'
        auto-create: true
        bom-filename: 'sbom.backend.cyclonedx.json'

    - name: Upload frontend SBOM
      uses: DependencyTrack/gh-upload-sbom@v4
      with:
        protocol: ${{ vars.DT_API_PROTOCOL }}
        server-hostname: ${{ vars.DT_API_HOSTNAME }}
        port: ${{ vars.DT_API_PORT }}
        api-key: ${{ secrets.DT_API_KEY }}
        project-name: 'YaleAccess Frontend'
        project-version: 'main'
        parent-name: 'YaleAccess'
        parent-version: 'main'
        auto-create: true
        bom-filename: 'sbom.frontend.cyclonedx.json'