From d398fcf6db2137791bff354a98bb5bea5853b15f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Festim=20Re=C3=A7i?=
 <45433214+FestimReqi@users.noreply.github.com>
Date: Wed, 22 Jul 2026 15:41:22 +0200
Subject: [PATCH] ci: add build test and dependency workflows

---
 .github/dependabot.yml           |  21 ++++++
 .github/pull_request_template.md |  27 +++++++
 .github/workflows/ci.yml         | 122 +++++++++++++++++++++++++++++++
 README.md                        |  10 ++-
 4 files changed, 179 insertions(+), 1 deletion(-)
 create mode 100644 .github/dependabot.yml
 create mode 100644 .github/pull_request_template.md
 create mode 100644 .github/workflows/ci.yml

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 0000000..2610c9d
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,21 @@
+version: 2
+updates:
+  - package-ecosystem: nuget
+    directory: /
+    schedule:
+      interval: weekly
+      day: monday
+    open-pull-requests-limit: 5
+    labels:
+      - dependencies
+      - nuget
+
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+      day: monday
+    open-pull-requests-limit: 5
+    labels:
+      - dependencies
+      - github-actions
diff --git a/.github/pull_request_template.md b/.github/pull_request_template.md
new file mode 100644
index 0000000..f97e09d
--- /dev/null
+++ b/.github/pull_request_template.md
@@ -0,0 +1,27 @@
+## Summary
+
+<!-- What changed and why? -->
+
+## Change type
+
+- [ ] Feature
+- [ ] Fix
+- [ ] Refactoring
+- [ ] Tests
+- [ ] Documentation or tooling
+
+## Verification
+
+<!-- List the commands or checks you ran. -->
+
+## Security and data considerations
+
+<!-- Note changes to authentication, secrets, sensitive data, or persistence. -->
+
+## Checklist
+
+- [ ] The solution builds and relevant tests pass.
+- [ ] Documentation is updated where needed.
+- [ ] Database migrations are included or marked not applicable.
+- [ ] No secrets, plaintext API keys, or generated build output are included.
+- [ ] The change is focused and does not weaken existing tests.
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
new file mode 100644
index 0000000..9668e5d
--- /dev/null
+++ b/.github/workflows/ci.yml
@@ -0,0 +1,122 @@
+name: CI
+
+on:
+  pull_request:
+    branches:
+      - main
+  push:
+    branches:
+      - main
+  workflow_dispatch:
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+env:
+  DOTNET_NOLOGO: true
+  DOTNET_CLI_TELEMETRY_OPTOUT: true
+  DOTNET_SKIP_FIRST_TIME_EXPERIENCE: true
+
+jobs:
+  build-and-test:
+    name: Build, test, and verify dependencies
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@v6
+
+      - name: Set up .NET 10
+        uses: actions/setup-dotnet@v5
+        with:
+          dotnet-version: 10.0.x
+
+      - name: Show .NET environment
+        run: dotnet --info
+
+      - name: Restore dependencies
+        run: dotnet restore FCode.TraceHub.sln
+
+      - name: Build
+        run: dotnet build FCode.TraceHub.sln --configuration Release --no-restore
+
+      - name: Run unit tests
+        run: >-
+          dotnet test tests/FCode.TraceHub.UnitTests/FCode.TraceHub.UnitTests.csproj
+          --configuration Release
+          --no-build
+          --no-restore
+          --logger "trx;LogFileName=unit-tests.trx"
+          --results-directory TestResults/Unit
+
+      - name: Check Docker availability
+        run: docker version
+
+      - name: Run PostgreSQL integration tests
+        run: >-
+          dotnet test tests/FCode.TraceHub.IntegrationTests/FCode.TraceHub.IntegrationTests.csproj
+          --configuration Release
+          --no-build
+          --no-restore
+          --logger "trx;LogFileName=integration-tests.trx"
+          --results-directory TestResults/Integration
+
+      - name: Check dependencies for known vulnerabilities
+        shell: pwsh
+        run: |
+          dotnet list FCode.TraceHub.sln package --vulnerable --include-transitive
+          if ($LASTEXITCODE -ne 0) {
+            exit $LASTEXITCODE
+          }
+
+          $json = dotnet list FCode.TraceHub.sln package `
+            --vulnerable `
+            --include-transitive `
+            --format json `
+            --output-version 1 `
+            --no-restore
+
+          if ($LASTEXITCODE -ne 0) {
+            exit $LASTEXITCODE
+          }
+
+          $report = $json | ConvertFrom-Json
+          $packages = @(
+            $report.projects | ForEach-Object {
+              $_.frameworks | ForEach-Object {
+                @($_.topLevelPackages) + @($_.transitivePackages)
+              }
+            }
+          )
+          $vulnerablePackages = @(
+            $packages | Where-Object {
+              $null -ne $_ -and @($_.vulnerabilities).Count -gt 0
+            }
+          )
+
+          if ($vulnerablePackages.Count -gt 0) {
+            Write-Error "Known vulnerabilities were found in $($vulnerablePackages.Count) package(s)."
+            foreach ($package in $vulnerablePackages) {
+              Write-Error "$($package.id) $($package.resolvedVersion)"
+              $package.vulnerabilities | ForEach-Object {
+                Write-Error "  $($_.severity): $($_.advisoryUrl)"
+              }
+            }
+            exit 1
+          }
+
+          Write-Host "No known vulnerable packages were found."
+
+      - name: Upload test results
+        if: ${{ always() && hashFiles('TestResults/**/*.trx') != '' }}
+        uses: actions/upload-artifact@v7
+        with:
+          name: tracehub-test-results
+          path: TestResults/**/*.trx
+          if-no-files-found: error
+          retention-days: 7
diff --git a/README.md b/README.md
index 79534a0..5e99789 100644
--- a/README.md
+++ b/README.md
@@ -1,5 +1,7 @@
 # FCODE TraceHub
 
+[![CI](https://github.com/fcode-design/fcode-tracehub/actions/workflows/ci.yml/badge.svg)](https://github.com/fcode-design/fcode-tracehub/actions/workflows/ci.yml)
+
 FCODE TraceHub is a lightweight, self-hosted monitoring and audit platform for ASP.NET Core applications.
 
 It aims to help development teams inspect API requests, application errors, audit events, email delivery logs, and background-job failures from one dashboard.
@@ -25,6 +27,7 @@ It aims to help development teams inspect API requests, application errors, audi
 - Unit and integration test projects
 - Sample ASP.NET Core application
 - Foundation for an installable ASP.NET Core SDK
+- GitHub Actions continuous integration
 
 ## Planned Features
 
@@ -37,7 +40,6 @@ It aims to help development teams inspect API requests, application errors, audi
 - Retention policies
 - Docker Compose deployment
 - OpenTelemetry support
-- GitHub Actions CI
 - NuGet package publishing
 
 ## Architecture
@@ -124,6 +126,12 @@ Check dependencies for known vulnerabilities:
 dotnet list FCode.TraceHub.sln package --vulnerable --include-transitive
 ```
 
+## Continuous Integration
+
+Every pull request to `main` runs a Release build, unit tests, PostgreSQL
+integration tests using a temporary Testcontainers-managed database, and a
+direct and transitive dependency vulnerability check.
+
 ## Project Status
 
 The project is in early development. APIs, package contracts, configuration, and database schemas may change before the first stable release.