♻️(build) Migrate to pnpm

.github/pull_request_template.md

@@ -1,3 +1,5 @@
+> Ensure your PR title matches [our semantics](https://github.com/chromeos/chromeos.dev/wiki#pr-titles)
+
 **Please describe what your Pull Request does**
 
 A clear and concise description of what your Pull Request does.

.github/workflows/nodejs.yml

@@ -11,38 +11,21 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@v2
-      - name: Setup Node
-        uses: actions/setup-node@v1
+      - name: Setup PNPM
+        uses: pnpm/action-setup@v2
         with:
-          node-version: 14
-      - name: Examine Node
-        run: |
-          node -v
-          npm -v
-      - name: Determine Lockfile
-        id: lockfile
-        run: |
-          if [[ -f "package-lock.json" || -f "npm-shrinkwrap.json" ]]; then
-            echo "::set-output name=exists::true"
-          else
-            echo "::set-output name=exists::false"
-          fi
-      - name: Install - Lockfile
-        if: steps.lockfile.outputs.exists == 'true'
-        run: |
-          npm ci --no-optional
-      - name: Install - No Lockfile
-        if: steps.lockfile.outputs.exists == 'false'
-        run: |
-          npm install
+          version: 7
       - name: Install CLI dependencies
         run: |
           sudo apt-get update
           sudo apt-get install giflib-tools webp ffmpeg
+      - name: Install project dependencies
+        run: |
+          pnpm install
       - name: Build and Test
         run: |
-          npm run build --if-present
-          npm test
+          pnpm run build
+          pnpm test
         env:
           CI: true
       - name: Upload built state

.github/workflows/sbom.yml

@@ -0,0 +1,31 @@
+name: SBOM upload
+
+on: 
+  workflow_dispatch:
+  push: 
+    branches: ["main"]
+
+jobs:
+  SBOM-upload:
+
+    runs-on: ubuntu-latest
+    permissions: 
+      id-token: write
+      contents: write
+
+    steps:
+    - uses: actions/checkout@v3
+    - name: Generate SBOM
+      run: | 
+        curl -Lo $RUNNER_TEMP/sbom-tool https://github.com/microsoft/sbom-tool/releases/latest/download/sbom-tool-linux-x64
+        chmod +x $RUNNER_TEMP/sbom-tool
+        $RUNNER_TEMP/sbom-tool generate -b . -bc . -pn ${{ github.repository }} -pv 1.0.0 -ps OwnerName -nsb https://sbom.mycompany.com -V Verbose
+
+    - uses: actions/upload-artifact@v3
+      with:
+        name: sbom
+        path: _manifest/spdx_2.2
+    - name: SBOM upload 
+      uses: jhutchings1/[email protected]
+      with:
+        filePath: "_manifest/spdx_2.2/"

.husky/pre-commit

@@ -1,4 +1,7 @@
 #!/bin/sh
 . "$(dirname "$0")/_/husky.sh"
 
-npx lint-staged
+# Make code run through TTY
+exec >/dev/tty 2>&1
+
+pnpm run lint:staged

.npmrc

@@ -0,0 +1 @@
+use-node-version=14.21.1

.prettierignore

@@ -5,4 +5,5 @@ functions/indexes
 .backstop
 site/public/js/indexes
 site/public/js/_data
-site/js/_data
+site/js/_data
+pnpm-lock.yaml