ci: add build test and dependency workflows

.github/dependabot.yml

@@ -0,0 +1,21 @@
+version: 2
+updates:
+  - package-ecosystem: nuget
+    directory: /
+    schedule:
+      interval: weekly
+      day: monday
+    open-pull-requests-limit: 5
+    labels:
+      - dependencies
+      - nuget
+
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+      day: monday
+    open-pull-requests-limit: 5
+    labels:
+      - dependencies
+      - github-actions

.github/pull_request_template.md

@@ -0,0 +1,27 @@
+## Summary
+
+<!-- What changed and why? -->
+
+## Change type
+
+- [ ] Feature
+- [ ] Fix
+- [ ] Refactoring
+- [ ] Tests
+- [ ] Documentation or tooling
+
+## Verification
+
+<!-- List the commands or checks you ran. -->
+
+## Security and data considerations
+
+<!-- Note changes to authentication, secrets, sensitive data, or persistence. -->
+
+## Checklist
+
+- [ ] The solution builds and relevant tests pass.
+- [ ] Documentation is updated where needed.
+- [ ] Database migrations are included or marked not applicable.
+- [ ] No secrets, plaintext API keys, or generated build output are included.
+- [ ] The change is focused and does not weaken existing tests.

.github/workflows/ci.yml

@@ -0,0 +1,122 @@
+name: CI
+
+on:
+  pull_request:
+    branches:
+      - main
+  push:
+    branches:
+      - main
+  workflow_dispatch:
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+env:
+  DOTNET_NOLOGO: true
+  DOTNET_CLI_TELEMETRY_OPTOUT: true
+  DOTNET_SKIP_FIRST_TIME_EXPERIENCE: true
+
+jobs:
+  build-and-test:
+    name: Build, test, and verify dependencies
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@v6
+
+      - name: Set up .NET 10
+        uses: actions/setup-dotnet@v5
+        with:
+          dotnet-version: 10.0.x
+
+      - name: Show .NET environment
+        run: dotnet --info
+
+      - name: Restore dependencies
+        run: dotnet restore FCode.TraceHub.sln
+
+      - name: Build
+        run: dotnet build FCode.TraceHub.sln --configuration Release --no-restore
+
+      - name: Run unit tests
+        run: >-
+          dotnet test tests/FCode.TraceHub.UnitTests/FCode.TraceHub.UnitTests.csproj
+          --configuration Release
+          --no-build
+          --no-restore
+          --logger "trx;LogFileName=unit-tests.trx"
+          --results-directory TestResults/Unit
+
+      - name: Check Docker availability
+        run: docker version
+
+      - name: Run PostgreSQL integration tests
+        run: >-
+          dotnet test tests/FCode.TraceHub.IntegrationTests/FCode.TraceHub.IntegrationTests.csproj
+          --configuration Release
+          --no-build
+          --no-restore
+          --logger "trx;LogFileName=integration-tests.trx"
+          --results-directory TestResults/Integration
+
+      - name: Check dependencies for known vulnerabilities
+        shell: pwsh
+        run: |
+          dotnet list FCode.TraceHub.sln package --vulnerable --include-transitive
+          if ($LASTEXITCODE -ne 0) {
+            exit $LASTEXITCODE
+          }
+
+          $json = dotnet list FCode.TraceHub.sln package `
+            --vulnerable `
+            --include-transitive `
+            --format json `
+            --output-version 1 `
+            --no-restore
+
+          if ($LASTEXITCODE -ne 0) {
+            exit $LASTEXITCODE
+          }
+
+          $report = $json | ConvertFrom-Json
+          $packages = @(
+            $report.projects | ForEach-Object {
+              $_.frameworks | ForEach-Object {
+                @($_.topLevelPackages) + @($_.transitivePackages)
+              }
+            }
+          )
+          $vulnerablePackages = @(
+            $packages | Where-Object {
+              $null -ne $_ -and @($_.vulnerabilities).Count -gt 0
+            }
+          )
+
+          if ($vulnerablePackages.Count -gt 0) {
+            Write-Error "Known vulnerabilities were found in $($vulnerablePackages.Count) package(s)."
+            foreach ($package in $vulnerablePackages) {
+              Write-Error "$($package.id) $($package.resolvedVersion)"
+              $package.vulnerabilities | ForEach-Object {
+                Write-Error "  $($_.severity): $($_.advisoryUrl)"
+              }
+            }
+            exit 1
+          }
+
+          Write-Host "No known vulnerable packages were found."
+
+      - name: Upload test results
+        if: ${{ always() && hashFiles('TestResults/**/*.trx') != '' }}
+        uses: actions/upload-artifact@v7
+        with:
+          name: tracehub-test-results
+          path: TestResults/**/*.trx
+          if-no-files-found: error
+          retention-days: 7

README.md

@@ -1,5 +1,7 @@
 # FCODE TraceHub
 
+[![CI](https://github.com/fcode-design/fcode-tracehub/actions/workflows/ci.yml/badge.svg)](https://github.com/fcode-design/fcode-tracehub/actions/workflows/ci.yml)
+
 FCODE TraceHub is a lightweight, self-hosted monitoring and audit platform for ASP.NET Core applications.
 
 It aims to help development teams inspect API requests, application errors, audit events, email delivery logs, and background-job failures from one dashboard.
@@ -25,6 +27,7 @@ It aims to help development teams inspect API requests, application errors, audi
 - Unit and integration test projects
 - Sample ASP.NET Core application
 - Foundation for an installable ASP.NET Core SDK
+- GitHub Actions continuous integration
 
 ## Planned Features
 
@@ -37,7 +40,6 @@ It aims to help development teams inspect API requests, application errors, audi
 - Retention policies
 - Docker Compose deployment
 - OpenTelemetry support
-- GitHub Actions CI
 - NuGet package publishing
 
 ## Architecture
@@ -124,6 +126,12 @@ Check dependencies for known vulnerabilities:
 dotnet list FCode.TraceHub.sln package --vulnerable --include-transitive
 ```
 
+## Continuous Integration
+
+Every pull request to `main` runs a Release build, unit tests, PostgreSQL
+integration tests using a temporary Testcontainers-managed database, and a
+direct and transitive dependency vulnerability check.
+
 ## Project Status
 
 The project is in early development. APIs, package contracts, configuration, and database schemas may change before the first stable release.