Add website code scanning, dependency updates and frontend and Kotlin coverage

2 files changed, 69 insertions, 2 deletions

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index b6c53df..91eeeea 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -10,6 +10,7 @@ on:
 
 permissions:
   contents: read
+  id-token: write
 
 concurrency:
   group: website-${{ github.ref }}
@@ -32,8 +33,14 @@ jobs:
         working-directory: frontend
       - run: npm run check
         working-directory: frontend
-      - run: npm test
+      - run: npm run test:coverage
         working-directory: frontend
+      - uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
+        with:
+          use_oidc: true
+          files: frontend/coverage/lcov.info
+          flags: website-frontend
+          fail_ci_if_error: true
       - run: npm run format:check
         working-directory: frontend
       - run: npm run build
@@ -52,8 +59,14 @@ jobs:
         with:
           gradle-version: '9.6.0'
           cache-provider: basic
-      - run: gradle test bootJar --no-daemon
+      - run: gradle test jacocoTestReport bootJar --no-daemon
         working-directory: backend
+      - uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
+        with:
+          use_oidc: true
+          files: backend/build/reports/jacoco/test/jacocoTestReport.xml
+          flags: website-backend
+          fail_ci_if_error: true
 
   dependency-review:
     if: github.event_name == 'pull_request'
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
new file mode 100644
index 0000000..2088ed7
--- /dev/null
+++ b/.github/workflows/codeql.yml
@@ -0,0 +1,54 @@
+# SPDX-FileCopyrightText: 2026 Progmasoft <support@progmasoft.com>
+# SPDX-License-Identifier: AGPL-3.0-or-later WITH AdditionRef-Progmasoft-Patent-Grant-1.1
+
+name: CodeQL
+on:
+  push:
+    branches: [main]
+  pull_request:
+  schedule:
+    - cron: '43 4 * * 1'
+permissions:
+  actions: read
+  contents: read
+  security-events: write
+jobs:
+  analyze:
+    name: ${{ matrix.language }}
+    runs-on: macos-15
+    timeout-minutes: 45
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - language: actions
+            build_mode: none
+          - language: javascript-typescript
+            build_mode: none
+          - language: java-kotlin
+            build_mode: manual
+    steps:
+      - uses: actions/checkout@v7
+      - uses: actions/setup-java@v6
+        if: matrix.language == 'java-kotlin'
+        with:
+          distribution: temurin
+          java-version: '25'
+      - uses: gradle/actions/setup-gradle@v6
+        if: matrix.language == 'java-kotlin'
+        with:
+          gradle-version: '9.6.0'
+      - uses: github/codeql-action/init@7999b86c43a865dc79d8923397f35af22de63401 # v4
+        with:
+          languages: ${{ matrix.language }}
+          build-mode: ${{ matrix.build_mode }}
+          config-file: ./.github/codeql/codeql-config.yml
+          queries: security-extended
+      - name: Build Kotlin backend for extraction
+        if: matrix.language == 'java-kotlin'
+        run: gradle classes --no-daemon
+        working-directory: backend
+      - uses: github/codeql-action/analyze@7999b86c43a865dc79d8923397f35af22de63401 # v4
+        with:
+          category: /language:${{ matrix.language }}
+