feat: add sbom

.github/dependabot.yml

@@ -8,8 +8,8 @@ updates:
 - package-ecosystem: "cargo" # See documentation for possible values
   directory: "/" # Location of package manifests
   schedule:
-    interval: "weekly"
+    interval: "daily"
 - package-ecosystem: "npm" # See documentation for possible values
   directory: "/" # Location of package manifests
   schedule:
-    interval: "weekly"
+    interval: "daily"

.github/workflows/rust-sbom.yml

@@ -0,0 +1,48 @@
+# This workflow uses actions that are not certified by GitHub.
+# They are provided by a third-party and are governed by
+# separate terms of service, privacy policy, and support
+# documentation.
+# rust-clippy is a tool that runs a bunch of lints to catch common
+# mistakes in your Rust code and help improve your Rust code.
+# More details at https://github.com/rust-lang/rust-clippy
+# and https://rust-lang.github.io/rust-clippy/
+
+name: rust-sbom gen
+
+on:
+  push:
+    branches: ['main']
+    paths:
+      - '**/Cargo.toml'
+      - '**/Cargo.lock'
+      - 'package.json'
+  pull_request:
+    # The branches below must be a subset of the branches above
+    branches: ['main']
+  schedule:
+    - cron: '50 23 * * *'
+
+jobs:
+  rust-sbom:
+    name: Run rust-clippy analyzing
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      security-events: write
+      actions: read # only required for a private repository by github/codeql-action/upload-sarif to get the Action run status
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - uses: anchore/sbom-action@v0
+        with:
+          path: .
+          artifact-name: sbom.json
+          format: json
+      - name: Push to DepTrack
+        uses: DependencyTrack/gh-upload-sbom@v3
+        with:
+          serverhostname: ${{ secrets.DEPENDENCYTRACK_SERVERHOSTNAME }}
+          apikey: ${{ secrets.DEPENDENCYTRACK_APIKEY }}
+          bomfilename: 'sbom.json'
+          project: d2e4343b-4344-4537-830e-fdce096473c4

.github/workflows/sonar.desacyml

@@ -0,0 +1,63 @@
+# This workflow uses actions that are not certified by GitHub.
+# They are provided by a third-party and are governed by
+# separate terms of service, privacy policy, and support
+# documentation.
+# rust-clippy is a tool that runs a bunch of lints to catch common
+# mistakes in your Rust code and help improve your Rust code.
+# More details at https://github.com/rust-lang/rust-clippy
+# and https://rust-lang.github.io/rust-clippy/
+
+name: sonar
+
+on:
+  push:
+    branches: ['main', '*']
+    paths:
+      - '**/back/**/*.rs'
+      - 'folio_content/**/*'
+      - '**/pong/**/*.rs'
+      - '**/front/**/*'
+      - 'libs/front/**/*'
+      - 'folio_content/**/*'
+  schedule:
+    - cron: '50 23 * * *'
+
+jobs:
+  rust-pre-analyze:
+    name: Run rust sonar pre analyze
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Install Rust toolchain
+        uses: dtolnay/rust-toolchain@stable
+        with:
+          toolchain: stable
+          components: clippy, rustfmt
+
+      - name: Install required cargo
+        run: cargo install cargo-audit cargo-sonar && cargo install --locked cargo-outdated
+
+      - name: Run rust-clippy
+        run: cargo clippy --all-features --message-format=json > clippy-report.json
+        continue-on-error: true
+
+      - name: Run audit
+        run: cargo audit --json > audit-report.json
+        continue-on-error: true
+      - name: Run outdated
+        run: cargo outdated --format json --depth 1 > outdated-report.json
+        continue-on-error: true
+      - name: Make report
+        run: cargo sonar --clippy --audit --outdated --clippy-path clippy-report.json --audit-path audit-report.json --outdated-path outdated-report.json
+      - name: Upload report
+        uses: actions/upload-artifact@v4
+        with:
+          name: sonar-report
+          path: sonar-issues.json
+      - name: SonarQube Scan
+        uses: SonarSource/sonarqube-scan-action@v4
+        env:
+          SONAR_TOKEN: ${{ secrets.SONARQUBE_KEY }}
+          SONAR_HOST_URL: ${{ secrets.SONARQUBE_HOST }}