feat: complete CI/CD pipeline with lint enforcement, Docker coverage for all components, and Go CodeQL analysis

.github/workflows/ci.yml

@@ -24,7 +24,7 @@ jobs:
         run: chmod +x backend/gradlew
 
       - name: Build and test
-        run: cd backend && ./gradlew build test
+        run: cd backend && ./gradlew build --no-daemon
         env:
           JWT_SECRET: ci-test-jwt-secret-not-used-in-production-placeholder
           ENCRYPTION_KEY: ci-test-encryption-key-placeholder
@@ -36,6 +36,13 @@ jobs:
           name: backend-test-report
           path: backend/build/reports/tests/test/
 
+      - name: Upload coverage report
+        uses: actions/upload-artifact@v4
+        if: always()
+        with:
+          name: backend-coverage-report
+          path: backend/build/reports/jacoco/test/
+
   frontend:
     name: Frontend (Vue 3/TypeScript)
     runs-on: ubuntu-latest
@@ -53,7 +60,7 @@ jobs:
         run: cd frontend && npm ci
 
       - name: Lint
-        run: cd frontend && npm run lint || true
+        run: cd frontend && npm run lint
 
       - name: Build
         run: cd frontend && npm run build

.github/workflows/codeql.yml

@@ -37,7 +37,7 @@ jobs:
         run: chmod +x backend/gradlew
 
       - name: Build for CodeQL
-        run: cd backend && ./gradlew classes
+        run: cd backend && ./gradlew classes --no-daemon
         env:
           JWT_SECRET: codeql-placeholder-not-real
           ENCRYPTION_KEY: codeql-placeholder-not-real
@@ -68,3 +68,34 @@ jobs:
         uses: github/codeql-action/analyze@v3
         with:
           category: '/language:javascript-typescript'
+
+  analyze-go:
+    name: Analyze Go
+    runs-on: ubuntu-latest
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up Go
+        uses: actions/setup-go@v5
+        with:
+          go-version-file: cli/go.mod
+          cache-dependency-path: cli/go.sum
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@v3
+        with:
+          languages: go
+          queries: security-extended
+
+      - name: Build for CodeQL
+        run: cd cli && go build ./...
+
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@v3
+        with:
+          category: '/language:go'

.github/workflows/docker.yml

@@ -3,12 +3,13 @@ name: Docker Build & Push
 on:
   push:
     branches: [ main ]
+  pull_request:
+    branches: [ main ]
 
 jobs:
   docker:
     name: Build and Push Docker Images
     runs-on: ubuntu-latest
-    needs: []
     permissions:
       contents: read
       packages: write
@@ -17,6 +18,7 @@ jobs:
       - uses: actions/checkout@v4
 
       - name: Log in to GitHub Container Registry
+        if: github.event_name == 'push'
         uses: docker/login-action@v3
         with:
           registry: ghcr.io
@@ -39,7 +41,7 @@ jobs:
         uses: docker/build-push-action@v5
         with:
           context: ./backend
-          push: true
+          push: ${{ github.event_name == 'push' }}
           tags: ${{ steps.meta-backend.outputs.tags }}
           labels: ${{ steps.meta-backend.outputs.labels }}
           cache-from: type=gha
@@ -58,8 +60,27 @@ jobs:
         uses: docker/build-push-action@v5
         with:
           context: ./frontend
-          push: true
+          push: ${{ github.event_name == 'push' }}
           tags: ${{ steps.meta-frontend.outputs.tags }}
           labels: ${{ steps.meta-frontend.outputs.labels }}
           cache-from: type=gha
           cache-to: type=gha,mode=max
+
+      - name: Extract metadata for CLI
+        id: meta-cli
+        uses: docker/metadata-action@v5
+        with:
+          images: ghcr.io/${{ github.repository }}/cli
+          tags: |
+            type=sha,prefix=
+            type=raw,value=latest,enable={{is_default_branch}}
+
+      - name: Build and push CLI image
+        uses: docker/build-push-action@v5
+        with:
+          context: ./cli
+          push: ${{ github.event_name == 'push' }}
+          tags: ${{ steps.meta-cli.outputs.tags }}
+          labels: ${{ steps.meta-cli.outputs.labels }}
+          cache-from: type=gha
+          cache-to: type=gha,mode=max

frontend/.eslintrc.cjs

@@ -0,0 +1,12 @@
+/* eslint-env node */
+module.exports = {
+  root: true,
+  extends: [
+    'plugin:vue/vue3-essential',
+    'eslint:recommended',
+    '@vue/eslint-config-typescript'
+  ],
+  parserOptions: {
+    ecmaVersion: 'latest'
+  }
+}