Add CI, validation, and (mocked) AWS CD GitHub Actions workflows

[devin-ai-integration]

Summary

Adds GitHub Actions CI/CD for this JHipster monolith. Every command is taken from the repo's own pom.xml / package.json scripts and was run locally on this branch (results below) — nothing invented.

• .github/workflows/ci.yml (push to main/master + PRs): three jobs — build (fast path, ./mvnw -ntp -B verify -DskipTests -Pprod, uploads the jar), backend (./mvnw -ntp -B verify → surefire + failsafe + JaCoCo; JUnit report published via mikepenz/action-junit-report, target/site/jacoco*/ uploaded as a coverage artifact), and frontend (npm run lint, npm test → Vitest with coverage into target/test-results). No matrix: the app pins exactly one Java (21) and one Node (24.13.0) version in pom.xml, so a matrix would only add noise.
• .github/workflows/validation.yml: format (npm run prettier:check, ./mvnw spotless:check, ./mvnw checkstyle:check — this repo's checkstyle.xml is the JHipster nohttp ruleset) and dependency-scan (npm audit --audit-level=high, non-blocking, plus a Trivy fs scan uploaded as SARIF to code scanning), also on a weekly cron.
• .github/workflows/cd.yml: Jib → ECR → ECS deploy, fully mocked.
• .github/dependabot.yml: maven / npm / github-actions, weekly, with grouped minor+patch updates.
• Docs: new .github/README.md (workflow table, mocked-value table, secrets/variables, how to make CD real) plus a short pointer section in the root README.md.

Both CI and Validation use concurrency groups that cancel superseded runs on branches but never on main/master, and least-privilege permissions: (contents: read by default; security-events: write only on the SARIF job, id-token: write only on the CD jobs that assume a role).

CD is mocked and triple-gated

All AWS identifiers are placeholders (123456789012, us-east-1, demo-cluster, demo-jhipster, arn:aws:iam::123456789012:role/demo-github-actions-deploy), marked as such in a header comment and at each use. It cannot reach real infra:

1. trigger is workflow_dispatch only;
2. dry_run input defaults to true — every AWS step is if: dry_run == 'false', and the mock path echoes the exact aws ecs update-service / kubectl set image command it would have run;
3. even with dry_run=false, a real run also requires repo variable ENABLE_REAL_DEPLOY == 'true' (unset here).

The dry-run path still genuinely exercises Jib via jib:dockerBuild -Dimage=... (local daemon, no push), and the deploy job renders a real ECS task definition through amazon-ecs-render-task-definition so the templating is validated even in mock mode. production uses a GitHub environment so the deploy job pauses for required-reviewer approval.

Verification

Run locally on this branch:

Check	Result
./mvnw -ntp -B verify	BUILD SUCCESS — 47 unit + 163 integration tests, 0 failures; JaCoCo written to target/site/jacoco{,-it}
npm test (lint + Vitest coverage)	pass
npm run prettier:check	pass
./mvnw spotless:check checkstyle:check	pass, 0 violations
actionlint on all three workflows	clean
YAML parse of all .github/**/*.yml	valid

Not run locally: the CD workflow (it targets non-existent mocked AWS resources; the dry-run path would need a Docker daemon and is the only path that could run at all) and the Trivy/SARIF upload step (requires the GitHub code-scanning API).

Artifact paths in the workflows were taken from the actual local build output, not guessed: target/surefire-reports/, target/failsafe-reports/, target/site/jacoco*/, and target/test-results/ (from vitest-base.config.ts's reportsDirectory).

Notes

• Actions are pinned to major tags (@v4, @v5, @v2, @v3). The one exception is aquasecurity/trivy-action, which publishes no major-version tag, so it is pinned to the exact release 0.28.0; this is documented in .github/README.md and Dependabot's github-actions ecosystem will keep it current.
• JAVA_VERSION / NODE_VERSION are duplicated as workflow env vars mirroring pom.xml; they need to be updated together when the pom bumps.

Link to Devin session: https://partner-workshops.devinenterprise.com/sessions/f746db0d50d24ed6beec3e79267a8f92
Requested by: @mbatchelor81

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.

[devin-ai-integration]

Runtime verification of the CI/CD workflow commands

Ran the workflow commands that hadn't been executed locally, on a clean checkout of this branch (JDK 21.0.11, Node 22 shell / Node 24.13.0 via frontend-maven-plugin), plus an app smoke test. GitHub Actions CI on this PR is green (all 6 checks).

Command (source)	Result
npm ci after rm -rf node_modules (ci.yml)	✅ exit 0, 1924 packages
./mvnw -ntp -B verify -DskipTests -Pprod (ci.yml)	✅ BUILD SUCCESS, 92 MB boot jar + prod webapp bundle
npm run lint (ci.yml)	✅ exit 0, no findings

App regression smoke (dev profile, H2) — passed

Backend ./npmw run backend:start + ./npmw run start, logged in as admin, created a Bank Account and viewed it:

Health checks

Non-blocking observations

• npm ci reports 122 npm audit vulnerabilities (8 critical). validation.yml uses npm audit --audit-level=high || true, so this is report-only — expect a permanently noisy step.
• The prod build logs an enforcer DependencyConvergence WARNING for org.apache.commons:commons-text (1.13.1 vs 1.14.0 via liquibase-core). Warning only today; would become a build failure if the rule is ever set to fail.
• cd.yml is untested by design: all AWS values are mocked placeholders and it is workflow_dispatch + dry-run gated.

Written by Devin