Put both halves in one branch, keep the deployments independent

[bgard68]

main carried the API. frontend carried the Angular app and a full copy of the API source. That's what this removes.

The duplication, measured

• 43 duplicated C# files
• 5 duplicated workflow files (ci, codeql, gitleaks, dependency-review, branch-isolation)
• 1 workflow whose only job was policing the split (branch-isolation.yml)

It had already cost something real. The two branches drifted onto different codeql-action versions, and because Dependabot ignore rules and ecosystems are per-entry, the frontend branch's NuGet packages were never scanned at all until this week.

The key point

The branch split was never what kept the deployments independent — the path filters do that, and they work identically on one branch:

Change	Deploy API	Deploy site	Backend CI	Frontend CI	CodeQL
lottery-web/** only	✗	✓	✓	✓	✓
src/** only	✓	✗	✓	✗	✓
docs / *.md only	✗	✗	✗	✗	✗
both	✓	✓	✓	✓	✓

Verified by simulating GitHub's path matching against the real filters, not by assuming.

Also in here

• codeql.yml becomes a two-language matrix (csharp + javascript-typescript) instead of two files that can drift apart again. fail-fast: false so one language failing doesn't hide the other's results.
• Docs excluded from push builds. Deliberately on push only — pull_request stays unfiltered, because a required status check that is skipped never reports and would leave the PR blocked forever rather than passing. ci-frontend.yml already documented that reasoning.
• dependabot.yml: 5 entries → 3, no target-branch. That per-entry duplication is exactly what caused the unscanned NuGet gap.
• branch-isolation.yml deleted — nothing left to keep apart.

Verification in the merged tree

dotnet restore --locked-mode clean · dotnet build -warnaserror zero warnings · 321 backend tests · 105 frontend specs, 100% lines · ng build · check:swa (5 security headers, no inline script) · npm audit clean.

Rollback

The frontend branch is deliberately untouched. Nothing is deleted there by this PR. Merge this, watch both deploys behave, and only then delete it — or walk away and nothing is lost.

After merging

Two follow-ups that need repo settings, not code:

1. Update branch protection — Branch isolation is no longer a check, and Analyze (csharp) becomes Analyze (csharp) + Analyze (javascript-typescript).
2. Delete the frontend branch once you're satisfied.

🤖 Generated with Claude Code