Add website code scanning, dependency updates and frontend and Kotlin coverage

5 files changed, 120 insertions, 2 deletions

diff --git a/.github/codeql/codeql-config.yml b/.github/codeql/codeql-config.yml
new file mode 100644
index 0000000..0fde565
--- /dev/null
+++ b/.github/codeql/codeql-config.yml
@@ -0,0 +1,9 @@
+# SPDX-FileCopyrightText: 2026 Progmasoft <support@progmasoft.com>
+# SPDX-License-Identifier: AGPL-3.0-or-later WITH AdditionRef-Progmasoft-Patent-Grant-1.1
+
+name: Visual XSharp website owned sources
+paths-ignore:
+  - frontend/node_modules
+  - frontend/dist
+  - backend/build
+
diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 0000000..b19178a
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,18 @@
+# SPDX-FileCopyrightText: 2026 Progmasoft <support@progmasoft.com>
+# SPDX-License-Identifier: AGPL-3.0-or-later WITH AdditionRef-Progmasoft-Patent-Grant-1.1
+
+version: 2
+updates:
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+  - package-ecosystem: npm
+    directory: /frontend
+    schedule:
+      interval: weekly
+  - package-ecosystem: gradle
+    directory: /backend
+    schedule:
+      interval: weekly
+
diff --git a/.github/pull_request_template.md b/.github/pull_request_template.md
new file mode 100644
index 0000000..88eb954
--- /dev/null
+++ b/.github/pull_request_template.md
@@ -0,0 +1,24 @@
+<!--
+SPDX-FileCopyrightText: 2026 Progmasoft <support@progmasoft.com>
+SPDX-License-Identifier: AGPL-3.0-or-later WITH AdditionRef-Progmasoft-Patent-Grant-1.1
+-->
+
+## User-facing change
+
+Describe the Visual X# website behavior or content changed. This repository is not the Progmasoft account/ViGet app.
+
+## Verification
+
+- [ ] Frontend checks, tests, formatting, and build were run where relevant.
+- [ ] Kotlin/Spring tests were run where relevant.
+- [ ] en-US/de-DE, light/dark, accessibility, and small-screen behavior were considered for UI changes.
+- [ ] Internal links, forum availability messaging, and the legacy ViGet redirect were checked if affected.
+- [ ] No credentials, generated output, or unrelated files are included.
+
+Commands and results (including anything not run):
+
+```text
+
+```
+
+Screenshots or recordings for visual changes:
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index b6c53df..91eeeea 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -10,6 +10,7 @@ on:
 
 permissions:
   contents: read
+  id-token: write
 
 concurrency:
   group: website-${{ github.ref }}
@@ -32,8 +33,14 @@ jobs:
         working-directory: frontend
       - run: npm run check
         working-directory: frontend
-      - run: npm test
+      - run: npm run test:coverage
         working-directory: frontend
+      - uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
+        with:
+          use_oidc: true
+          files: frontend/coverage/lcov.info
+          flags: website-frontend
+          fail_ci_if_error: true
       - run: npm run format:check
         working-directory: frontend
       - run: npm run build
@@ -52,8 +59,14 @@ jobs:
         with:
           gradle-version: '9.6.0'
           cache-provider: basic
-      - run: gradle test bootJar --no-daemon
+      - run: gradle test jacocoTestReport bootJar --no-daemon
         working-directory: backend
+      - uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
+        with:
+          use_oidc: true
+          files: backend/build/reports/jacoco/test/jacocoTestReport.xml
+          flags: website-backend
+          fail_ci_if_error: true
 
   dependency-review:
     if: github.event_name == 'pull_request'
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
new file mode 100644
index 0000000..2088ed7
--- /dev/null
+++ b/.github/workflows/codeql.yml
@@ -0,0 +1,54 @@
+# SPDX-FileCopyrightText: 2026 Progmasoft <support@progmasoft.com>
+# SPDX-License-Identifier: AGPL-3.0-or-later WITH AdditionRef-Progmasoft-Patent-Grant-1.1
+
+name: CodeQL
+on:
+  push:
+    branches: [main]
+  pull_request:
+  schedule:
+    - cron: '43 4 * * 1'
+permissions:
+  actions: read
+  contents: read
+  security-events: write
+jobs:
+  analyze:
+    name: ${{ matrix.language }}
+    runs-on: macos-15
+    timeout-minutes: 45
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - language: actions
+            build_mode: none
+          - language: javascript-typescript
+            build_mode: none
+          - language: java-kotlin
+            build_mode: manual
+    steps:
+      - uses: actions/checkout@v7
+      - uses: actions/setup-java@v6
+        if: matrix.language == 'java-kotlin'
+        with:
+          distribution: temurin
+          java-version: '25'
+      - uses: gradle/actions/setup-gradle@v6
+        if: matrix.language == 'java-kotlin'
+        with:
+          gradle-version: '9.6.0'
+      - uses: github/codeql-action/init@7999b86c43a865dc79d8923397f35af22de63401 # v4
+        with:
+          languages: ${{ matrix.language }}
+          build-mode: ${{ matrix.build_mode }}
+          config-file: ./.github/codeql/codeql-config.yml
+          queries: security-extended
+      - name: Build Kotlin backend for extraction
+        if: matrix.language == 'java-kotlin'
+        run: gradle classes --no-daemon
+        working-directory: backend
+      - uses: github/codeql-action/analyze@7999b86c43a865dc79d8923397f35af22de63401 # v4
+        with:
+          category: /language:${{ matrix.language }}
+