Add initial styles, .gitignore, SonarQube config, and update GitHub Actions

.github/dependabot.yml

@@ -0,0 +1,29 @@
+version: 2
+updates:
+  - package-ecosystem: npm
+    directory: /provaonline-frontend
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 5
+    groups:
+      frontend-minor-patch:
+        update-types:
+          - minor
+          - patch
+
+  - package-ecosystem: maven
+    directory: /provaonline-backend
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 5
+    groups:
+      backend-minor-patch:
+        update-types:
+          - minor
+          - patch
+
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 5

.github/pull_request_template.md

@@ -0,0 +1,13 @@
+## Summary
+
+- 
+
+## Checks
+
+- [ ] Frontend check/build passes
+- [ ] Backend tests pass
+- [ ] Security checks reviewed
+
+## Notes
+
+- 

.github/workflows/ci.yml

@@ -0,0 +1,66 @@
+name: CI
+
+on:
+  pull_request:
+    branches:
+      - main
+      - development
+  push:
+    branches:
+      - main
+      - development
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ci-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  frontend:
+    name: Frontend
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: provaonline-frontend
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v6
+        with:
+          node-version: 22
+          cache: npm
+          cache-dependency-path: provaonline-frontend/package-lock.json
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Check Svelte
+        run: npm run check
+
+      - name: Audit dependencies
+        run: npm run audit
+
+      - name: Build frontend
+        run: npm run build
+
+  backend:
+    name: Backend
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+
+      - name: Setup Java
+        uses: actions/setup-java@v5
+        with:
+          distribution: temurin
+          java-version: 17
+          cache: maven
+
+      - name: Verify backend
+        working-directory: provaonline-backend
+        run: mvn --batch-mode verify

.github/workflows/security.yml

@@ -0,0 +1,123 @@
+name: Security
+
+on:
+  pull_request:
+    branches:
+      - main
+      - development
+  push:
+    branches:
+      - main
+      - development
+  schedule:
+    - cron: "24 6 * * 1"
+  workflow_dispatch:
+
+permissions:
+  actions: read
+  contents: read
+  security-events: write
+
+concurrency:
+  group: security-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  codeql:
+    name: CodeQL
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        language:
+          - java-kotlin
+          - javascript-typescript
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@v4
+        with:
+          languages: ${{ matrix.language }}
+
+      - name: Autobuild
+        uses: github/codeql-action/autobuild@v4
+
+      - name: Analyze
+        uses: github/codeql-action/analyze@v4
+
+  dependency-check:
+    name: OWASP Dependency Check
+    runs-on: ubuntu-latest
+    timeout-minutes: 60
+    if: github.event_name != 'push'
+    env:
+      DEPENDENCY_CHECK_DATA: ${{ github.workspace }}/.dependency-check-data
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+
+      - name: Setup Java
+        uses: actions/setup-java@v5
+        with:
+          distribution: temurin
+          java-version: 17
+          cache: maven
+
+      - name: Generate weekly cache key
+        id: cache-key
+        shell: bash
+        run: echo "week=$(date -u +'%G-%V')" >> "$GITHUB_OUTPUT"
+
+      - name: Restore OWASP Dependency-Check data
+        id: dependency-check-cache
+        uses: actions/cache/restore@v5
+        with:
+          path: ${{ env.DEPENDENCY_CHECK_DATA }}
+          key: dependency-check-data-v2-${{ runner.os }}-${{ steps.cache-key.outputs.week }}
+          restore-keys: |
+            dependency-check-data-v2-${{ runner.os }}-
+
+      - name: Run OWASP Dependency-Check
+        shell: bash
+        working-directory: provaonline-backend
+        env:
+          NVD_API_KEY: ${{ secrets.NVD_API_KEY }}
+          CACHE_HIT: ${{ steps.dependency-check-cache.outputs.cache-hit }}
+        run: |
+          mkdir -p "${DEPENDENCY_CHECK_DATA}"
+
+          args=(
+            mvn --batch-mode org.owasp:dependency-check-maven:check
+            -DskipTests
+            "-DdataDirectory=${DEPENDENCY_CHECK_DATA}"
+            --file pom.xml
+          )
+
+          # Exact weekly cache hits already contain recent NVD data.
+          # Avoid contacting the NVD API on every pull request.
+          if [ "${CACHE_HIT}" = "true" ] && [ "${{ github.event_name }}" = "pull_request" ]; then
+            args+=("-DautoUpdate=false")
+          elif [ -n "${NVD_API_KEY}" ]; then
+            args+=("-DnvdApiKey=${NVD_API_KEY}")
+          fi
+
+          "${args[@]}"
+
+      - name: Save OWASP Dependency-Check data
+        if: success() && steps.dependency-check-cache.outputs.cache-hit != 'true'
+        uses: actions/cache/save@v5
+        with:
+          path: ${{ env.DEPENDENCY_CHECK_DATA }}
+          key: dependency-check-data-v2-${{ runner.os }}-${{ steps.cache-key.outputs.week }}
+
+      - name: Upload dependency check report
+        if: always()
+        uses: actions/upload-artifact@v7
+        with:
+          name: dependency-check-report
+          path: |
+            provaonline-backend/target/dependency-check-report.html
+            provaonline-backend/target/dependency-check-report.json
+          if-no-files-found: warn

.project

@@ -0,0 +1,11 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<projectDescription>
+	<name>ProvaOnline</name>
+	<comment></comment>
+	<projects>
+	</projects>
+	<buildSpec>
+	</buildSpec>
+	<natures>
+	</natures>
+</projectDescription>

.vscode/settings.json

@@ -0,0 +1,3 @@
+{
+    "java.configuration.updateBuildConfiguration": "automatic"
+}

README.md

@@ -14,8 +14,8 @@ It allows the creation and application of exams based on a JSON file containing
 To run the project, the following prerequisites need to be installed:
 
 - Maven 3.8.6
-- Node.js v20.11.0
-- npm 10.2.4
+- Node.js 22.x
+- npm 10.9.x
 
 ## Usage
 
@@ -29,6 +29,11 @@ To run the project, the following prerequisites need to be installed:
 
 
 Internally, Maven with the *frontend-maven-plugin* compile svelte pages, ensuring its availability in the Quarkus static folder.  Then, you don't need to start frontend project.
+## Development Workflow
+
+This repository uses `development` for day-to-day integration and `main` as the stable branch. Open pull requests into `development`, let CI/security checks pass, and promote `development` to `main` through a pull request when a release is ready.
+
+More details are available in `docs/development-process.md`.
 
 Additionally, within the resources folder, you'll find an examtests_questions.json file. I've included simulated questions for the Cloud Digital Leader exam as a sample. Feel free to substitute them with alternative questions as needed.
 

docs/development-process.md

@@ -0,0 +1,39 @@
+# Development Process
+
+## Branches
+
+- `main`: stable branch. Keep deployable and update only through pull requests.
+- `development`: integration branch for day-to-day work before promotion to `main`.
+- `feature/*`, `fix/*`, `chore/*`: short-lived branches created from `development`.
+
+## Minimal Flow
+
+1. Create a short-lived branch from `development`.
+2. Open a pull request back to `development`.
+3. Wait for CI and security checks to pass.
+4. Merge into `development`.
+5. Promote `development` to `main` through a pull request when a release is ready.
+
+## Required Repository Rules
+
+Configure branch protection in GitHub for `main` and `development`:
+
+- Require pull requests before merging.
+- Require the `CI` workflow to pass.
+- Require the `Security` workflow for `main`.
+- Require branches to be up to date before merging.
+- Disable force pushes and deletions.
+
+## Local Commands
+
+```bash
+cd provaonline-frontend
+npm ci
+npm run check
+npm run build
+```
+
+```bash
+cd provaonline-backend
+mvn verify
+```

provaonline-backend/.gitignore

@@ -0,0 +1,40 @@
+#Maven
+target/
+pom.xml.tag
+pom.xml.releaseBackup
+pom.xml.versionsBackup
+release.properties
+.flattened-pom.xml
+
+# Eclipse
+.project
+.classpath
+.settings/
+bin/
+
+# IntelliJ
+.idea
+*.ipr
+*.iml
+*.iws
+
+# NetBeans
+nb-configuration.xml
+
+# Visual Studio Code
+.vscode
+.factorypath
+
+# OSX
+.DS_Store
+
+# Vim
+*.swp
+*.swo
+
+# patch
+*.orig
+*.rej
+
+# Local environment
+.env

provaonline-backend/.mvn/wrapper/.gitignore

@@ -0,0 +1 @@
+maven-wrapper.jar