Add GitHub Actions CI/CD workflow (frontend, backend, package, SonarQube)

[devin-ai-integration]

Summary

Adds .github/workflows/ci.yml, which runs the build, lint and test commands this JHipster app already defines (mirroring the ci:* / java:* npm scripts). All commands were run locally on unmodified main first and they pass, so no step is marked continue-on-error. No application code or build config was changed.

Triggers: push to main, pull_request, workflow_dispatch. concurrency cancels superseded runs of the same ref. permissions: contents: read.

Job	Runs	Notes
frontend	npm ci → npm run lint (ESLint) → npm run prettier:check → npx ng test --coverage (Vitest, 401 tests) → npm run webapp:build:prod	Uploads target/test-results/ (lcov + sonar vitest XML). Calls ng test directly because npm test has a pretest hook that would run ESLint a second time.
backend	./mvnw checkstyle:check (nohttp) → ./mvnw javadoc:javadoc → ./mvnw -Pprod -Dskip.installnodenpm -Dskip.npm verify	Same as npm run ci:backend:test. -Pprod runs unit tests (surefire) and *IT integration tests (failsafe) against PostgreSQL 18.1 via Testcontainers, which uses the runner's Docker daemon, so no service container is needed. Uploads surefire/failsafe reports and JaCoCo (jacoco, jacoco-it), plus target/classes for Sonar.
package (CD)	./mvnw -Pprod -DskipTests verify → ./mvnw -Pprod -DskipTests jib:buildTar	Only on pushes to the default branch. Same as npm run java:jar:prod; the frontend-maven-plugin installs Node and builds the webapp into the jar. Jib writes the image to target/jib-image.tar (no registry and no push). Uploads the jar and image tarball.
sonarqube	SonarSource/sonarqube-scan-action@v8 with the existing sonar-project.properties	Needs frontend + backend and downloads their coverage/test/class artifacts. SONAR_TOKEN (secret) is exposed through env, and each step is gated with if: env.SONAR_TOKEN != '', so without the secret the job only prints a notice and passes. SONAR_HOST_URL comes from a repo variable, falling back to a secret, and is passed as -Dsonar.host.url because the properties file hard-codes localhost:9001.

Toolchain: Temurin JDK 21 (<java.version>21), Node 24.13.0 (<node.version> in pom.xml, engines in package.json and the devcontainer), and Maven 3.9.12 from ./mvnw. MAVEN_ARGS=-ntp --batch-mode is set globally. Caching uses setup-java cache: maven and setup-node cache: npm.

Actions: pinned to their current major versions: actions/checkout@v7, setup-java@v6, setup-node@v7, upload-artifact@v7, download-artifact@v8, sonarqube-scan-action@v8. The workflow passes actionlint 1.7.12.

Not included on purpose:

• Cypress e2e (ci:e2e:*): these need the packaged app running with a PostgreSQL service and Chrome, and upstream JHipster runs them as a separate heavyweight pipeline. They could be added later as their own job.
• Gatling: load tests that target a live server. They aren't meaningful as a CI gate.
• Image push or deploy: we have no registry or deploy credentials.

Link to Devin session: https://partner-workshops.devinenterprise.com/sessions/726872a9589f4c4f8b73c2daed922b30
Open in Devin Desktop: https://partner-workshops.devinenterprise.com/desktop/session/726872a9589f4c4f8b73c2daed922b30?variant=devin
Requested by: @mbatchelor81

[devin-ai-integration]

I'll fix CI failures and address comments from users with write access. I'll skip comments containing "(aside)".

• Disable automatic comment, CI, and merge conflict monitoring