Add GitHub Actions CI and mocked-AWS CD pipelines

[devin-ai-integration]

Summary

The repo had no .github/ directory (workflows were removed at import). This adds a standard CI pipeline plus a demo CD pipeline that is wired for AWS but cannot deploy anywhere, driven by the repo's actual tooling (mvnw, npmw/npm scripts, Jib from pom.xml, Java 21, Node 24.13.0).

CI (.github/workflows/ci.yml) — push to main + PRs, concurrency cancel-in-progress, permissions: contents: read, all actions SHA-pinned, Maven/npm caching, no continue-on-error:

• backend: ./mvnw -Pprod -Dskip.installnodenpm -Dskip.npm verify (frontend skipped — it's the other job's concern); uploads surefire/failsafe/JaCoCo reports.
• frontend: npm ci → lint → npm test (Vitest + coverage) → webapp:build:prod; uploads target/test-results.
• code-quality: prettier:check, checkstyle:check (nohttp), javadoc:javadoc, and actionlint over the workflow files.

CD (.github/workflows/cd.yml) — push to main + workflow_dispatch(environment: staging|production); configure → build-image (Jib) → deploy-staging → deploy-production, staging/production as GitHub Environments (approval gate = required reviewers on production), AWS auth exclusively via OIDC (configure-aws-credentials + id-token: write, no long-lived keys).

The safety mechanism is a single resolved flag rather than per-step guessing:

# configure job
if [ "${AWS_ACCOUNT_ID}" = "123456789012" ]; then dry_run=true; fi
# every push/deploy step
if: needs.configure.outputs.dry_run == 'false'
# mirrored no-op steps
if: needs.configure.outputs.dry_run == 'true'   # jib:buildTar + "would deploy" plan echo

All AWS identifiers are fake defaults supplied through vars.* (account 123456789012, role arn:aws:iam::123456789012:role/gha-deploy-ts-java-angular-jhipster, ECR demo/jhipster-sample-application, clusters demo-staging / demo-prod), so out of the box the image is built to a local tarball artifact and the deploy jobs only print a plan — no ECR push, no ECS API call. Setting a real AWS_ACCOUNT_ID is what arms the pipeline.

Also adds .github/dependabot.yml (Maven, npm with Angular packages grouped, github-actions — weekly) and docs/CICD.md documenting the jobs, the variable table with mock defaults, and the go-live checklist.

Validation (run locally in the sandbox)

• actionlint v1.7.12 on both workflows — clean
• ./mvnw -Pprod -Dskip.installnodenpm -Dskip.npm verify — 163 tests, BUILD SUCCESS
• npm run lint, npm test, npm run webapp:build:prod, npm run prettier:check — all pass
• ./mvnw -Pprod -DskipTests verify jib:buildTar (the CD dry-run path) — produced target/jib-image.tar

Not runnable here: the AWS-armed branches of the CD workflow (OIDC assumption, ECR push, ECS deploy) — they are guarded off by design and have no real account behind them.

Link to Devin session: https://partner-workshops.devinenterprise.com/sessions/ebe6570dc6c043d69c8747f605e03684

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring

[devin-ai-integration]

Runtime verification — app unaffected by the CI/CD-only changes

This PR touches only .github/workflows/*, .github/dependabot.yml and docs/CICD.md. To confirm the commands these workflows/docs invoke really produce a working app, the full dev golden path was run locally (Java 21, dev profile / in-memory H2 on :8080, Angular + Browsersync on :9000).

Golden path: login → entity list → entity detail

Logged in via the UI with admin/admin; navbar gains Entities + Administration.

Entities → Bank Account renders 10 seeded rows from the backend API.

Clicking View on row 1 loads /bank-account/1/view with the matching Name/Balance.

Backend health & admin Health page

GET http://localhost:9000/management/health (through the Browsersync proxy) → {"groups":["liveness","readiness"],"status":"UP"}

Administration → Health: Database, Disk space, Liveness state, Application, Readiness state, SSL all UP.

Other checks

• Entities → Label list renders 10 seeded rows.
• Zero uncaught JS console errors across the whole flow; backend log has no ERROR/Exception/5xx entries.
• actionlint run at the exact image SHA pinned in ci.yml over the workflow files: 0 findings.

No failures observed.