feat: Add GitHub Actions workflows for Docker build, publish, documentation deployment, and quality checks

- Implemented `docker-build.yml` for building and pushing Docker images with multi-platform support, Trivy security scanning, and conditional builds based on commit messages.
- Created `docker-publish.yml` for streamlined Docker image publishing with Trivy vulnerability scanning on push events.
- Added `docs.yml` to automate documentation deployment to GitHub Pages, including a custom HTML structure and markdown conversion.
- Introduced `propagate-changes.yml` to automate PR creation for synchronizing changes between main, development, and feature branches.
- Established `quality-checks.yml` for running backend (Go) and frontend (React) quality checks, including tests and linting.
- Developed `release.yml` for generating changelogs and creating GitHub releases upon version tag pushes.
- Set up `renovate.yml` for automated dependency updates on a daily schedule.

.github/workflows/auto-add-to-project.yml

@@ -0,0 +1,32 @@
+name: Auto-add issues and PRs to Project
+
+on:
+  issues:
+    types: [opened, reopened]
+  pull_request:
+    types: [opened, reopened]
+
+jobs:
+  add-to-project:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Determine project URL presence
+        id: project_check
+        run: |
+          if [ -n "${{ secrets.PROJECT_URL }}" ]; then
+            echo "has_project=true" >> $GITHUB_OUTPUT
+          else
+            echo "has_project=false" >> $GITHUB_OUTPUT
+          fi
+
+      - name: Add issue or PR to project
+        if: steps.project_check.outputs.has_project == 'true'
+        uses: actions/add-to-project@244f685bbc3b7adfa8466e08b698b5577571133e # v1.0.2
+        continue-on-error: true
+        with:
+          project-url: ${{ secrets.PROJECT_URL }}
+          github-token: ${{ secrets.ADD_TO_PROJECT_PAT }}
+
+      - name: Skip summary
+        if: steps.project_check.outputs.has_project == 'false'
+        run: echo "PROJECT_URL secret missing; skipping project assignment." >> $GITHUB_STEP_SUMMARY

.github/workflows/auto-label-issues.yml

@@ -0,0 +1,74 @@
+name: Auto-label Issues
+
+on:
+  issues:
+    types: [opened, edited]
+
+jobs:
+  auto-label:
+    runs-on: ubuntu-latest
+    permissions:
+      issues: write
+    steps:
+      - name: Auto-label based on title and body
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
+        with:
+          script: |
+            const issue = context.payload.issue;
+            const title = issue.title.toLowerCase();
+            const body = issue.body ? issue.body.toLowerCase() : '';
+            const labels = [];
+
+            // Priority detection
+            if (title.includes('[critical]') || body.includes('priority: critical')) {
+              labels.push('critical');
+            } else if (title.includes('[high]') || body.includes('priority: high')) {
+              labels.push('high');
+            } else if (title.includes('[medium]') || body.includes('priority: medium')) {
+              labels.push('medium');
+            } else if (title.includes('[low]') || body.includes('priority: low')) {
+              labels.push('low');
+            }
+
+            // Milestone detection
+            if (title.includes('[alpha]') || body.includes('milestone: alpha')) {
+              labels.push('alpha');
+            } else if (title.includes('[beta]') || body.includes('milestone: beta')) {
+              labels.push('beta');
+            } else if (title.includes('[post-beta]') || body.includes('milestone: post-beta')) {
+              labels.push('post-beta');
+            }
+
+            // Category detection
+            if (title.includes('architecture') || body.includes('architecture')) labels.push('architecture');
+            if (title.includes('backend') || body.includes('backend')) labels.push('backend');
+            if (title.includes('frontend') || body.includes('frontend')) labels.push('frontend');
+            if (title.includes('security') || body.includes('security')) labels.push('security');
+            if (title.includes('ssl') || title.includes('tls') || body.includes('certificate')) labels.push('ssl');
+            if (title.includes('sso') || body.includes('single sign-on')) labels.push('sso');
+            if (title.includes('waf') || body.includes('web application firewall')) labels.push('waf');
+            if (title.includes('crowdsec') || body.includes('crowdsec')) labels.push('crowdsec');
+            if (title.includes('caddy') || body.includes('caddy')) labels.push('caddy');
+            if (title.includes('database') || body.includes('database')) labels.push('database');
+            if (title.includes('ui') || title.includes('interface')) labels.push('ui');
+            if (title.includes('docker') || title.includes('deployment')) labels.push('deployment');
+            if (title.includes('monitoring') || title.includes('logging')) labels.push('monitoring');
+            if (title.includes('documentation') || title.includes('docs')) labels.push('documentation');
+            if (title.includes('test') || body.includes('testing')) labels.push('testing');
+            if (title.includes('performance') || body.includes('optimization')) labels.push('performance');
+            if (title.includes('plus') || body.includes('premium feature')) labels.push('plus');
+
+            // Feature detection
+            if (title.includes('feature') || body.includes('feature request')) labels.push('feature');
+
+            // Only add labels if we detected any
+            if (labels.length > 0) {
+              await github.rest.issues.addLabels({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                issue_number: issue.number,
+                labels: labels
+              });
+
+              console.log(`Added labels: ${labels.join(', ')}`);
+            }

.github/workflows/caddy-major-monitor.yml

@@ -0,0 +1,62 @@
+name: Monitor Caddy Major Release
+
+on:
+  schedule:
+    - cron: '17 7 * * 1' # Mondays at 07:17 UTC
+  workflow_dispatch: {}
+
+permissions:
+  contents: read
+  issues: write
+
+jobs:
+  check-caddy-major:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check for Caddy v3 and open issue
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
+        with:
+          script: |
+            const upstream = { owner: 'caddyserver', repo: 'caddy' };
+            const { data: releases } = await github.rest.repos.listReleases({
+              ...upstream,
+              per_page: 50,
+            });
+            const latestV3 = releases.find(r => /^v3\./.test(r.tag_name));
+            if (!latestV3) {
+              core.info('No Caddy v3 release detected.');
+              return;
+            }
+
+            const issueTitle = `Track upgrade to Caddy v3 (${latestV3.tag_name})`;
+
+            const { data: existing } = await github.rest.issues.listForRepo({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              state: 'open',
+              per_page: 100,
+            });
+
+            if (existing.some(i => i.title === issueTitle)) {
+              core.info('Issue already exists — nothing to do.');
+              return;
+            }
+
+            const body = [
+              'Caddy v3 has been released upstream and detected by the scheduled monitor.',
+              '',
+              `Detected release: ${latestV3.tag_name} (${latestV3.html_url})`,
+              '',
+              '- Create a feature branch to evaluate the v3 migration.',
+              '- Review breaking changes and update Docker base images/workflows.',
+              '- Validate Trivy scans and update any policies as needed.',
+              '',
+              'Current policy: remain on latest 2.x until v3 is validated.'
+            ].join('\n');
+
+            await github.rest.issues.create({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              title: issueTitle,
+              body,
+            });

.github/workflows/codeql.yml

@@ -0,0 +1,44 @@
+name: CodeQL - Analyze
+
+on:
+  push:
+    branches: [ main, development, 'feature/**' ]
+  pull_request:
+    branches: [ main, development ]
+  schedule:
+    - cron: '0 3 * * 1'
+
+permissions:
+  contents: read
+  security-events: write
+
+jobs:
+  analyze:
+    name: CodeQL analysis (${{ matrix.language }})
+    runs-on: ubuntu-latest
+    # Skip forked PRs where GITHUB_TOKEN lacks security-events permissions
+    if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.fork == false
+    permissions:
+      contents: read
+      security-events: write
+      actions: read
+    strategy:
+      fail-fast: false
+      matrix:
+        language: [ 'go', 'javascript-typescript' ]
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@c3d42c5d08633d8b33635fbd94b000a0e2585b3c # v3
+        with:
+          languages: ${{ matrix.language }}
+
+      - name: Autobuild
+        uses: github/codeql-action/autobuild@c3d42c5d08633d8b33635fbd94b000a0e2585b3c # v3
+
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@c3d42c5d08633d8b33635fbd94b000a0e2585b3c # v3
+        with:
+          category: "/language:${{ matrix.language }}"

.github/workflows/create-labels.yml

@@ -0,0 +1,78 @@
+name: Create Project Labels
+
+# This workflow only runs manually to set up labels
+on:
+  workflow_dispatch:
+
+jobs:
+  create-labels:
+    runs-on: ubuntu-latest
+    permissions:
+      issues: write
+    steps:
+      - name: Create all project labels
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
+        with:
+          script: |
+            const labels = [
+              // Priority labels
+              { name: 'critical', color: 'B60205', description: 'Must have for the release, blocks other work' },
+              { name: 'high', color: 'D93F0B', description: 'Important feature, should be included' },
+              { name: 'medium', color: 'FBCA04', description: 'Nice to have, can be deferred' },
+              { name: 'low', color: '0E8A16', description: 'Future enhancement, not urgent' },
+
+              // Milestone labels
+              { name: 'alpha', color: '5319E7', description: 'Part of initial alpha release' },
+              { name: 'beta', color: '0052CC', description: 'Part of beta release' },
+              { name: 'post-beta', color: '006B75', description: 'Post-beta enhancement' },
+
+              // Category labels
+              { name: 'architecture', color: 'C5DEF5', description: 'System design and structure' },
+              { name: 'backend', color: '1D76DB', description: 'Server-side code' },
+              { name: 'frontend', color: '5EBEFF', description: 'UI/UX code' },
+              { name: 'feature', color: 'A2EEEF', description: 'New functionality' },
+              { name: 'security', color: 'EE0701', description: 'Security-related' },
+              { name: 'ssl', color: 'F9D0C4', description: 'SSL/TLS certificates' },
+              { name: 'sso', color: 'D4C5F9', description: 'Single Sign-On' },
+              { name: 'waf', color: 'B60205', description: 'Web Application Firewall' },
+              { name: 'crowdsec', color: 'FF6B6B', description: 'CrowdSec integration' },
+              { name: 'caddy', color: '1F6FEB', description: 'Caddy-specific' },
+              { name: 'database', color: '006B75', description: 'Database-related' },
+              { name: 'ui', color: '7057FF', description: 'User interface' },
+              { name: 'deployment', color: '0E8A16', description: 'Docker, installation' },
+              { name: 'monitoring', color: 'FEF2C0', description: 'Logging and statistics' },
+              { name: 'documentation', color: '0075CA', description: 'Docs and guides' },
+              { name: 'testing', color: 'BFD4F2', description: 'Test suite' },
+              { name: 'performance', color: 'EDEDED', description: 'Optimization' },
+              { name: 'community', color: 'D876E3', description: 'Community building' },
+              { name: 'plus', color: 'FFD700', description: 'Premium/"Plus" feature' },
+              { name: 'enterprise', color: '8B4513', description: 'Enterprise-grade feature' }
+            ];
+
+            for (const label of labels) {
+              try {
+                await github.rest.issues.createLabel({
+                  owner: context.repo.owner,
+                  repo: context.repo.repo,
+                  name: label.name,
+                  color: label.color,
+                  description: label.description
+                });
+                console.log(`✓ Created label: ${label.name}`);
+              } catch (error) {
+                if (error.status === 422) {
+                  console.log(`⚠ Label already exists: ${label.name}`);
+                  // Update the label if it exists
+                  await github.rest.issues.updateLabel({
+                    owner: context.repo.owner,
+                    repo: context.repo.repo,
+                    name: label.name,
+                    color: label.color,
+                    description: label.description
+                  });
+                  console.log(`✓ Updated label: ${label.name}`);
+                } else {
+                  console.error(`✗ Error creating label ${label.name}:`, error.message);
+                }
+              }
+            }

.github/workflows/docker-build.yml

@@ -0,0 +1,277 @@
+name: Build and Push Docker Images
+
+on:
+  push:
+    branches:
+      - main           # Pushes to main → tags as "latest"
+      - development    # Pushes to development → tags as "dev"
+    tags:
+      - 'v*.*.*'       # Version tags (v1.0.0, v1.2.3, etc.) → tags as version number
+  workflow_dispatch:   # Allows manual trigger from GitHub UI
+
+env:
+  REGISTRY: ghcr.io
+  IMAGE_NAME: ${{ github.repository_owner }}/cpmp
+
+jobs:
+  build-and-push:
+    name: Build and Push Docker Image
+    runs-on: ubuntu-latest
+    concurrency:
+      group: docker-build-${{ github.ref }}
+      cancel-in-progress: true
+    outputs:
+      skip_build: ${{ steps.skip.outputs.skip_build }}
+    permissions:
+      contents: read
+      packages: write
+      security-events: write
+
+    steps:
+      # Step 1: Download the code
+      - name: 📥 Checkout code
+        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
+
+      - name: 🧪 Determine skip condition
+        id: skip
+        env:
+          ACTOR: ${{ github.actor }}
+          EVENT: ${{ github.event_name }}
+          HEAD_MSG: ${{ github.event.head_commit.message }}
+        run: |
+          should_skip=false
+          pr_title=""
+          if [ "$EVENT" = "pull_request" ]; then
+            pr_title=$(jq -r '.pull_request.title' "$GITHUB_EVENT_PATH" 2>/dev/null || echo '')
+          fi
+          if [ "$ACTOR" = "renovate[bot]" ]; then should_skip=true; fi
+          if echo "$HEAD_MSG" | grep -Ei '^chore\(deps' >/dev/null 2>&1; then should_skip=true; fi
+          if echo "$HEAD_MSG" | grep -Ei '^chore:' >/dev/null 2>&1; then should_skip=true; fi
+          if echo "$pr_title" | grep -Ei '^chore\(deps' >/dev/null 2>&1; then should_skip=true; fi
+          if echo "$pr_title" | grep -Ei '^chore:' >/dev/null 2>&1; then should_skip=true; fi
+          echo "skip_build=$should_skip" >> $GITHUB_OUTPUT
+          if [ "$should_skip" = true ]; then
+            echo "Skipping heavy docker build for actor=$ACTOR event=$EVENT (message/title matched)"
+          else
+            echo "Proceeding with full docker build"
+          fi
+
+      # Step 2: Set up QEMU for multi-platform builds (ARM, AMD64, etc.)
+      - name: 🔧 Set up QEMU
+        uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3
+
+      # Step 3: Set up Docker Buildx (advanced Docker builder)
+      - name: 🔧 Set up Docker Buildx
+        uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3
+
+      # Resolve immutable digest for Caddy base
+      - name: 📦 Resolve Caddy base digest
+        id: caddy
+        run: |
+          docker pull caddy:2-alpine
+          DIGEST=$(docker inspect --format='{{index .RepoDigests 0}}' caddy:2-alpine)
+          echo "image=$DIGEST" >> $GITHUB_OUTPUT
+
+      # Step 4: Log in to GitHub Container Registry
+      - name: 🔐 Log in to GitHub Container Registry
+        uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.PROJECT_TOKEN }}
+
+      # Step 5: Figure out what tags to use
+      - name: 🏷️ Extract metadata (tags, labels)
+        id: meta
+        uses: docker/metadata-action@318604b99e75e41977312d83839a89be02ca4893 # v5
+        with:
+          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
+          tags: |
+            # Tag "latest" for main branch
+            type=raw,value=latest,enable={{is_default_branch}}
+            # Tag "dev" for development branch
+            type=raw,value=dev,enable=${{ github.ref == 'refs/heads/development' }}
+            # Tag version numbers from git tags (v1.0.0 → 1.0.0)
+            type=semver,pattern={{version}}
+            # Tag major.minor from git tags (v1.2.3 → 1.2)
+            type=semver,pattern={{major}}.{{minor}}
+            # Tag major from git tags (v1.2.3 → 1)
+            type=semver,pattern={{major}}
+            # Ephemeral tag for pull requests (derive number from GITHUB_REF if available)
+            type=raw,value=pr-${{ github.ref_name }},enable=${{ github.event_name == 'pull_request' }}
+            # Short SHA tag as fallback (for non-default non-dev push events)
+            type=sha,format=short,enable=${{ github.event_name != 'pull_request' }}
+
+      # Step 6: Build the frontend first
+      - name: 🎨 Build frontend
+        if: steps.skip.outputs.skip_build != 'true'
+        run: |
+          cd frontend
+          npm ci
+          npm run build
+
+      # Step 7: Build and push Docker image
+      - name: 🐳 Build and push Docker image
+        if: steps.skip.outputs.skip_build != 'true'
+        uses: docker/build-push-action@ca052bb54ab0790a636c9b5f226502c73d547a25 # v5
+        id: build
+        with:
+          context: .
+          file: ./Dockerfile
+          platforms: ${{ github.event_name == 'pull_request' && 'linux/amd64' || 'linux/amd64,linux/arm64' }}
+          push: ${{ github.event_name != 'pull_request' }}
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
+          build-args: |
+            CADDY_IMAGE=${{ steps.caddy.outputs.image }}
+
+      # Step 8: Run Trivy scan (table output first for visibility)
+      - name: 📋 Run Trivy scan (table output)
+        if: github.event_name != 'pull_request' && steps.skip.outputs.skip_build != 'true'
+        id: trivy_table
+        continue-on-error: true
+        uses: aquasecurity/trivy-action@master
+        with:
+          image-ref: ${{ fromJSON(steps.meta.outputs.json).tags[0] }}
+          format: 'table'
+          severity: 'CRITICAL,HIGH'
+          exit-code: '0'
+
+      # Step 9: Run Trivy security scan (SARIF)
+      - name: 🔍 Run Trivy vulnerability scanner
+        if: github.event_name != 'pull_request' && steps.skip.outputs.skip_build != 'true'
+        id: trivy
+        continue-on-error: true
+        uses: aquasecurity/trivy-action@master
+        with:
+          image-ref: ${{ fromJSON(steps.meta.outputs.json).tags[0] }}
+          format: 'sarif'
+          output: 'trivy-results.sarif'
+          exit-code: '0'
+          severity: 'CRITICAL,HIGH'
+
+      # Step 10: Upload Trivy results to GitHub Security tab
+      - name: 📤 Upload Trivy results to GitHub Security
+        uses: github/codeql-action/upload-sarif@c3d42c5d08633d8b33635fbd94b000a0e2585b3c # v3
+        if: github.event_name != 'pull_request' && steps.skip.outputs.skip_build != 'true' && (steps.trivy.outcome == 'success' || steps.trivy.outcome == 'failure')
+        with:
+          sarif_file: 'trivy-results.sarif'
+
+      # Step 11: Fail if vulnerabilities found
+      - name: ❌ Check for vulnerabilities
+        if: github.event_name != 'pull_request' && steps.skip.outputs.skip_build != 'true' && steps.trivy_table.outcome == 'failure'
+        run: |
+          echo "::error::CRITICAL or HIGH vulnerabilities found in image"
+          exit 1
+
+      # Step 11: Create a summary
+      - name: 📋 Create summary
+        if: steps.skip.outputs.skip_build != 'true'
+        run: |
+          echo "## 🎉 Docker Image Built Successfully!" >> $GITHUB_STEP_SUMMARY
+          echo "" >> $GITHUB_STEP_SUMMARY
+          echo "### 📦 Image Details" >> $GITHUB_STEP_SUMMARY
+          echo "- **Registry**: GitHub Container Registry (ghcr.io)" >> $GITHUB_STEP_SUMMARY
+          echo "- **Repository**: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}" >> $GITHUB_STEP_SUMMARY
+          echo "- **Tags**: " >> $GITHUB_STEP_SUMMARY
+          echo '```' >> $GITHUB_STEP_SUMMARY
+          echo "${{ steps.meta.outputs.tags }}" >> $GITHUB_STEP_SUMMARY
+          echo '```' >> $GITHUB_STEP_SUMMARY
+          echo "" >> $GITHUB_STEP_SUMMARY
+          echo "### 🚀 How to Use" >> $GITHUB_STEP_SUMMARY
+          echo '```bash' >> $GITHUB_STEP_SUMMARY
+          echo "docker pull ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:latest" >> $GITHUB_STEP_SUMMARY
+          echo "docker run -d -p 8080:8080 -v caddy_data:/app/data ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:latest" >> $GITHUB_STEP_SUMMARY
+          echo '```' >> $GITHUB_STEP_SUMMARY
+
+      - name: 📋 Create skip summary
+        if: steps.skip.outputs.skip_build == 'true'
+        run: |
+          echo "## 🚫 Docker Build Skipped" >> $GITHUB_STEP_SUMMARY
+          echo "Reason: renovate bot or chore(deps)/chore commit/PR title." >> $GITHUB_STEP_SUMMARY
+          echo "Actor: ${{ github.actor }}" >> $GITHUB_STEP_SUMMARY
+          echo "Event: ${{ github.event_name }}" >> $GITHUB_STEP_SUMMARY
+
+  test-image:
+    name: Test Docker Image
+    needs: build-and-push
+    runs-on: ubuntu-latest
+    if: needs.build-and-push.outputs.skip_build != 'true'
+
+    steps:
+      # Ensure normalized lowercase IMAGE_NAME for this job as well
+      - name: 🔤 Normalize image name
+        run: |
+          raw="${{ github.repository_owner }}/${{ github.event.repository.name }}"
+          echo "IMAGE_NAME=$(echo "$raw" | tr '[:upper:]' '[:lower:]')" >> $GITHUB_ENV
+      # Step 1: Figure out which tag to test
+      - name: 🏷️ Determine image tag
+        id: tag
+        run: |
+          if [[ "${{ github.ref }}" == "refs/heads/main" ]]; then
+            echo "tag=latest" >> $GITHUB_OUTPUT
+          elif [[ "${{ github.ref }}" == "refs/heads/development" ]]; then
+            echo "tag=dev" >> $GITHUB_OUTPUT
+          elif [[ "${{ github.ref }}" == refs/tags/v* ]]; then
+            echo "tag=${GITHUB_REF#refs/tags/v}" >> $GITHUB_OUTPUT
+          else
+            echo "tag=sha-$(echo ${{ github.sha }} | cut -c1-7)" >> $GITHUB_OUTPUT
+          fi
+
+      # Step 1.5: Log in to GitHub Container Registry (Required for private/internal images)
+      - name: 🔐 Log in to GitHub Container Registry
+        uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.PROJECT_TOKEN }}
+
+      # Step 2: Pull the image we just built
+      - name: 📥 Pull Docker image
+        run: docker pull ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ steps.tag.outputs.tag }}
+
+      # Step 3: Start the container
+      - name: 🚀 Run container
+        run: |
+          docker run -d \
+            --name test-container \
+            -p 8080:8080 \
+            ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ steps.tag.outputs.tag }}
+
+      # Step 4/5: Wait and check health with retries
+      - name: 🏥 Test health endpoint (retries)
+        run: |
+          set +e
+          for i in $(seq 1 30); do
+            code=$(curl -s -o /dev/null -w "%{http_code}" http://localhost:8080/api/v1/health || echo "000")
+            if [ "$code" = "200" ]; then
+              echo "✅ Health check passed on attempt $i"
+              exit 0
+            fi
+            echo "Attempt $i/30: health not ready (code=$code); waiting..."
+            sleep 2
+          done
+          echo "❌ Health check failed after retries"
+          docker logs test-container || true
+          exit 1
+
+      # Step 6: Check the logs for errors
+      - name: 📋 Check container logs
+        if: always()
+        run: docker logs test-container
+
+      # Step 7: Clean up
+      - name: 🧹 Stop container
+        if: always()
+        run: docker stop test-container && docker rm test-container
+
+      # Step 8: Summary
+      - name: 📋 Create test summary
+        if: always()
+        run: |
+          echo "## 🧪 Docker Image Test Results" >> $GITHUB_STEP_SUMMARY
+          echo "" >> $GITHUB_STEP_SUMMARY
+          echo "- **Image**: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ steps.tag.outputs.tag }}" >> $GITHUB_STEP_SUMMARY
+          echo "- **Health Check**: ${{ job.status == 'success' && '✅ Passed' || '❌ Failed' }}" >> $GITHUB_STEP_SUMMARY

.github/workflows/docker-publish.yml

@@ -0,0 +1,134 @@
+name: Docker Build & Publish
+
+on:
+  push:
+    branches:
+      - main
+      - development
+    tags:
+      - 'v*.*.*'
+  pull_request:
+    branches:
+      - main
+      - development
+  workflow_call:
+
+env:
+  REGISTRY: ghcr.io
+  IMAGE_NAME: ${{ github.repository_owner }}/cpmp
+
+jobs:
+  build-and-push:
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    permissions:
+      contents: read
+      packages: write
+      security-events: write
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
+
+      - name: Determine skip condition
+        id: skip
+        env:
+          ACTOR: ${{ github.actor }}
+          EVENT: ${{ github.event_name }}
+          HEAD_MSG: ${{ github.event.head_commit.message }}
+        run: |
+          should_skip=false
+          pr_title=""
+          if [ "$EVENT" = "pull_request" ]; then
+            pr_title=$(jq -r '.pull_request.title' "$GITHUB_EVENT_PATH" 2>/dev/null || echo '')
+          fi
+          if [ "$ACTOR" = "renovate[bot]" ]; then should_skip=true; fi
+          if echo "$HEAD_MSG" | grep -Ei '^chore\(deps' >/dev/null 2>&1; then should_skip=true; fi
+          if echo "$HEAD_MSG" | grep -Ei '^chore:' >/dev/null 2>&1; then should_skip=true; fi
+          if echo "$pr_title" | grep -Ei '^chore\(deps' >/dev/null 2>&1; then should_skip=true; fi
+          if echo "$pr_title" | grep -Ei '^chore:' >/dev/null 2>&1; then should_skip=true; fi
+          echo "skip_build=$should_skip" >> $GITHUB_OUTPUT
+
+      - name: Set up QEMU
+        if: steps.skip.outputs.skip_build != 'true'
+        uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3.7.0
+
+      - name: Set up Docker Buildx
+        if: steps.skip.outputs.skip_build != 'true'
+        uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1
+
+      - name: Resolve Caddy base digest
+        if: steps.skip.outputs.skip_build != 'true'
+        id: caddy
+        run: |
+          docker pull caddy:2-alpine
+          DIGEST=$(docker inspect --format='{{index .RepoDigests 0}}' caddy:2-alpine)
+          echo "image=$DIGEST" >> $GITHUB_OUTPUT
+
+      - name: Log in to Container Registry
+        if: github.event_name != 'pull_request' && steps.skip.outputs.skip_build != 'true'
+        uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: ${{ github.actor }}
+          password: ${{ secrets.PROJECT_TOKEN }}
+
+      - name: Extract metadata (tags, labels)
+        if: steps.skip.outputs.skip_build != 'true'
+        id: meta
+        uses: docker/metadata-action@dbef88086f6cef02e264edb7dbf63250c17cef6c # v5.0.1
+        with:
+          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
+          tags: |
+            type=raw,value=latest,enable={{is_default_branch}}
+            type=raw,value=dev,enable=${{ github.ref == 'refs/heads/development' }}
+            type=semver,pattern={{version}}
+            type=semver,pattern={{major}}.{{minor}}
+            type=semver,pattern={{major}}
+
+      - name: Build and push Docker image
+        if: steps.skip.outputs.skip_build != 'true'
+        id: build-and-push
+        uses: docker/build-push-action@ca052bb54ab0790a636c9b5f226502c73d547a25 # v5.4.0
+        with:
+          context: .
+          # PRs: amd64 only, no push. Pushes: amd64+arm64, push.
+          platforms: ${{ github.event_name == 'pull_request' && 'linux/amd64' || 'linux/amd64,linux/arm64' }}
+          push: ${{ github.event_name != 'pull_request' }}
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
+          build-args: |
+            VERSION=${{ steps.meta.outputs.version }}
+            BUILD_DATE=${{ fromJSON(steps.meta.outputs.json).labels['org.opencontainers.image.created'] }}
+            VCS_REF=${{ github.sha }}
+            CADDY_IMAGE=${{ steps.caddy.outputs.image }}
+
+      # Trivy steps only on push
+      - name: Run Trivy scan (table output)
+        if: github.event_name != 'pull_request' && steps.skip.outputs.skip_build != 'true'
+        uses: aquasecurity/trivy-action@b6643a29fecd7f34b3597bc6acb0a98b03d33ff8 # 0.33.1
+        with:
+          image-ref: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}@${{ steps.build-and-push.outputs.digest }}
+          format: 'table'
+          severity: 'CRITICAL,HIGH'
+          exit-code: '0'
+        continue-on-error: true
+
+      - name: Run Trivy vulnerability scanner (SARIF)
+        if: github.event_name != 'pull_request' && steps.skip.outputs.skip_build != 'true'
+        id: trivy
+        uses: aquasecurity/trivy-action@b6643a29fecd7f34b3597bc6acb0a98b03d33ff8 # 0.33.1
+        with:
+          image-ref: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}@${{ steps.build-and-push.outputs.digest }}
+          format: 'sarif'
+          output: 'trivy-results.sarif'
+          severity: 'CRITICAL,HIGH'
+        continue-on-error: true
+
+      - name: Upload Trivy results
+        if: github.event_name != 'pull_request' && steps.skip.outputs.skip_build != 'true'
+        uses: github/codeql-action/upload-sarif@c3d42c5d08633d8b33635fbd94b000a0e2585b3c # v3
+        with:
+          sarif_file: 'trivy-results.sarif'

.github/workflows/docs.yml

@@ -0,0 +1,353 @@
+name: Deploy Documentation to GitHub Pages
+
+on:
+  push:
+    branches:
+      - main           # Deploy docs when pushing to main
+    paths:
+      - 'docs/**'      # Only run if docs folder changes
+      - 'README.md'    # Or if README changes
+      - '.github/workflows/docs.yml'  # Or if this workflow changes
+  workflow_dispatch:   # Allow manual trigger
+
+# Sets permissions to allow deployment to GitHub Pages
+permissions:
+  contents: read
+  pages: write
+  id-token: write
+
+# Allow only one concurrent deployment
+concurrency:
+  group: "pages"
+  cancel-in-progress: false
+
+jobs:
+  build:
+    name: Build Documentation
+    runs-on: ubuntu-latest
+
+    steps:
+      # Step 1: Get the code
+      - name: 📥 Checkout code
+        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
+
+      # Step 2: Set up Node.js (for building any JS-based doc tools)
+      - name: 🔧 Set up Node.js
+        uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5
+        with:
+          node-version: '20.19.5'
+
+      # Step 3: Create a beautiful docs site structure
+      - name: 📝 Build documentation site
+        run: |
+          # Create output directory
+          mkdir -p _site
+
+          # Copy all markdown files
+          cp README.md _site/
+          cp -r docs _site/
+
+          # Create a simple HTML index that looks nice
+          cat > _site/index.html << 'EOF'
+          <!DOCTYPE html>
+          <html lang="en">
+          <head>
+            <meta charset="UTF-8">
+            <meta name="viewport" content="width=device-width, initial-scale=1.0">
+            <title>Caddy Proxy Manager Plus - Documentation</title>
+            <link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/@picocss/pico@2/css/pico.min.css">
+            <style>
+              :root {
+                --primary: #1d4ed8;
+                --primary-hover: #1e40af;
+              }
+              body {
+                background-color: #0f172a;
+                color: #e2e8f0;
+              }
+              header {
+                background: linear-gradient(135deg, #1e3a8a 0%, #1d4ed8 100%);
+                padding: 3rem 0;
+                text-align: center;
+                margin-bottom: 2rem;
+              }
+              header h1 {
+                color: white;
+                font-size: 2.5rem;
+                margin-bottom: 0.5rem;
+              }
+              header p {
+                color: #e0e7ff;
+                font-size: 1.25rem;
+              }
+              .container {
+                max-width: 1200px;
+                margin: 0 auto;
+                padding: 2rem;
+              }
+              .card {
+                background: #1e293b;
+                border: 1px solid #334155;
+                border-radius: 12px;
+                padding: 1.5rem;
+                margin-bottom: 1.5rem;
+                transition: transform 0.2s, box-shadow 0.2s;
+              }
+              .card:hover {
+                transform: translateY(-4px);
+                box-shadow: 0 8px 16px rgba(0, 0, 0, 0.3);
+              }
+              .card h3 {
+                color: #60a5fa;
+                margin-top: 0;
+                display: flex;
+                align-items: center;
+                gap: 0.5rem;
+              }
+              .card p {
+                color: #cbd5e1;
+                margin-bottom: 1rem;
+              }
+              .card a {
+                color: #60a5fa;
+                text-decoration: none;
+                font-weight: 600;
+                display: inline-flex;
+                align-items: center;
+                gap: 0.5rem;
+              }
+              .card a:hover {
+                color: #93c5fd;
+              }
+              .badge {
+                display: inline-block;
+                padding: 0.25rem 0.75rem;
+                border-radius: 9999px;
+                font-size: 0.875rem;
+                font-weight: 600;
+                margin-left: 0.5rem;
+              }
+              .badge-beginner {
+                background: #10b981;
+                color: white;
+              }
+              .badge-advanced {
+                background: #f59e0b;
+                color: white;
+              }
+              .grid {
+                display: grid;
+                grid-template-columns: repeat(auto-fit, minmax(300px, 1fr));
+                gap: 1.5rem;
+              }
+              footer {
+                text-align: center;
+                padding: 3rem 0;
+                color: #64748b;
+                border-top: 1px solid #334155;
+                margin-top: 4rem;
+              }
+            </style>
+          </head>
+          <body>
+            <header>
+              <h1>🚀 Caddy Proxy Manager Plus</h1>
+              <p>Make your websites easy to reach - No coding required!</p>
+            </header>
+
+            <div class="container">
+              <section>
+                <h2>👋 Welcome!</h2>
+                <p style="font-size: 1.1rem; color: #cbd5e1;">
+                  This documentation will help you get started with Caddy Proxy Manager Plus.
+                  Whether you're a complete beginner or an experienced developer, we've got you covered!
+                </p>
+              </section>
+
+              <h2 style="margin-top: 3rem;">📚 Getting Started</h2>
+              <div class="grid">
+                <div class="card">
+                  <h3>🏠 Getting Started Guide <span class="badge badge-beginner">Start Here</span></h3>
+                  <p>Your first setup in just 5 minutes! We'll walk you through everything step by step.</p>
+                  <a href="docs/getting-started.html">Read the Guide →</a>
+                </div>
+
+                <div class="card">
+                  <h3>📖 README <span class="badge badge-beginner">Essential</span></h3>
+                  <p>Learn what the app does, how to install it, and see examples of what you can build.</p>
+                  <a href="README.html">Read More →</a>
+                </div>
+
+                <div class="card">
+                  <h3>📥 Import Guide</h3>
+                  <p>Already using Caddy? Learn how to bring your existing configuration into the app.</p>
+                  <a href="docs/import-guide.html">Import Your Configs →</a>
+                </div>
+              </div>
+
+              <h2 style="margin-top: 3rem;">🔧 Developer Documentation</h2>
+              <div class="grid">
+                <div class="card">
+                  <h3>🔌 API Reference <span class="badge badge-advanced">Advanced</span></h3>
+                  <p>Complete REST API documentation with examples in JavaScript and Python.</p>
+                  <a href="docs/api.html">View API Docs →</a>
+                </div>
+
+                <div class="card">
+                  <h3>💾 Database Schema <span class="badge badge-advanced">Advanced</span></h3>
+                  <p>Understand how data is stored, relationships, and backup strategies.</p>
+                  <a href="docs/database-schema.html">View Schema →</a>
+                </div>
+
+                <div class="card">
+                  <h3>✨ Contributing Guide</h3>
+                  <p>Want to help make this better? Learn how to contribute code, docs, or ideas.</p>
+                  <a href="CONTRIBUTING.html">Start Contributing →</a>
+                </div>
+              </div>
+
+              <h2 style="margin-top: 3rem;">📋 All Documentation</h2>
+              <div class="card">
+                <h3>📚 Documentation Index</h3>
+                <p>Browse all available documentation organized by topic and skill level.</p>
+                <a href="docs/index.html">View Full Index →</a>
+              </div>
+
+              <h2 style="margin-top: 3rem;">🆘 Need Help?</h2>
+              <div class="card" style="background: #1e3a8a; border-color: #1e40af;">
+                <h3 style="color: #dbeafe;">Get Support</h3>
+                <p style="color: #bfdbfe;">
+                  Stuck? Have questions? We're here to help!
+                </p>
+                <div style="display: flex; gap: 1rem; flex-wrap: wrap; margin-top: 1rem;">
+                  <a href="https://github.com/Wikid82/CaddyProxyManagerPlus/discussions"
+                     style="background: white; color: #1e40af; padding: 0.5rem 1rem; border-radius: 6px; text-decoration: none;">
+                    💬 Ask a Question
+                  </a>
+                  <a href="https://github.com/Wikid82/CaddyProxyManagerPlus/issues"
+                     style="background: white; color: #1e40af; padding: 0.5rem 1rem; border-radius: 6px; text-decoration: none;">
+                    🐛 Report a Bug
+                  </a>
+                  <a href="https://github.com/Wikid82/CaddyProxyManagerPlus"
+                     style="background: white; color: #1e40af; padding: 0.5rem 1rem; border-radius: 6px; text-decoration: none;">
+                    ⭐ View on GitHub
+                  </a>
+                </div>
+              </div>
+            </div>
+
+            <footer>
+              <p>Built with ❤️ by <a href="https://github.com/Wikid82" style="color: #60a5fa;">@Wikid82</a></p>
+              <p>Made for humans, not just techies!</p>
+            </footer>
+          </body>
+          </html>
+          EOF
+
+          # Convert markdown files to HTML using a simple converter
+          npm install -g marked
+
+          # Convert each markdown file
+          for file in _site/docs/*.md; do
+            if [ -f "$file" ]; then
+              filename=$(basename "$file" .md)
+              marked "$file" -o "_site/docs/${filename}.html" --gfm
+            fi
+          done
+
+          # Convert README and CONTRIBUTING
+          marked _site/README.md -o _site/README.html --gfm
+          if [ -f "CONTRIBUTING.md" ]; then
+            cp CONTRIBUTING.md _site/
+            marked _site/CONTRIBUTING.md -o _site/CONTRIBUTING.html --gfm
+          fi
+
+          # Add simple styling to all HTML files
+          for html_file in _site/*.html _site/docs/*.html; do
+            if [ -f "$html_file" ] && [ "$html_file" != "_site/index.html" ]; then
+              # Add a header with navigation to each page
+              temp_file="${html_file}.tmp"
+              cat > "$temp_file" << 'HEADER'
+          <!DOCTYPE html>
+          <html lang="en">
+          <head>
+            <meta charset="UTF-8">
+            <meta name="viewport" content="width=device-width, initial-scale=1.0">
+            <title>Caddy Proxy Manager Plus - Documentation</title>
+            <link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/@picocss/pico@2/css/pico.min.css">
+            <style>
+              body { background-color: #0f172a; color: #e2e8f0; }
+              nav { background: #1e293b; padding: 1rem; margin-bottom: 2rem; }
+              nav a { color: #60a5fa; margin-right: 1rem; text-decoration: none; }
+              nav a:hover { color: #93c5fd; }
+              main { max-width: 900px; margin: 0 auto; padding: 2rem; }
+              a { color: #60a5fa; }
+              code { background: #1e293b; color: #fbbf24; padding: 0.2rem 0.4rem; border-radius: 4px; }
+              pre { background: #1e293b; padding: 1rem; border-radius: 8px; overflow-x: auto; }
+              pre code { background: none; padding: 0; }
+            </style>
+          </head>
+          <body>
+            <nav>
+              <a href="/">🏠 Home</a>
+              <a href="/docs/index.html">📚 Docs</a>
+              <a href="/docs/getting-started.html">🚀 Get Started</a>
+              <a href="https://github.com/Wikid82/CaddyProxyManagerPlus">⭐ GitHub</a>
+            </nav>
+            <main>
+          HEADER
+
+              # Append original content
+              cat "$html_file" >> "$temp_file"
+
+              # Add footer
+              cat >> "$temp_file" << 'FOOTER'
+            </main>
+            <footer style="text-align: center; padding: 2rem; color: #64748b;">
+              <p>Caddy Proxy Manager Plus - Built with ❤️ for the community</p>
+            </footer>
+          </body>
+          </html>
+          FOOTER
+
+              mv "$temp_file" "$html_file"
+            fi
+          done
+
+          echo "✅ Documentation site built successfully!"
+
+      # Step 4: Upload the built site
+      - name: 📤 Upload artifact
+        uses: actions/upload-pages-artifact@7b1f4a764d45c48632c6b24a0339c27f5614fb0b # v4
+        with:
+          path: '_site'
+
+  deploy:
+    name: Deploy to GitHub Pages
+    environment:
+      name: github-pages
+      url: ${{ steps.deployment.outputs.page_url }}
+    runs-on: ubuntu-latest
+    needs: build
+
+    steps:
+      # Deploy to GitHub Pages
+      - name: 🚀 Deploy to GitHub Pages
+        id: deployment
+        uses: actions/deploy-pages@d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e # v4
+
+      # Create a summary
+      - name: 📋 Create deployment summary
+        run: |
+          echo "## 🎉 Documentation Deployed!" >> $GITHUB_STEP_SUMMARY
+          echo "" >> $GITHUB_STEP_SUMMARY
+          echo "Your documentation is now live at:" >> $GITHUB_STEP_SUMMARY
+          echo "🔗 ${{ steps.deployment.outputs.page_url }}" >> $GITHUB_STEP_SUMMARY
+          echo "" >> $GITHUB_STEP_SUMMARY
+          echo "### 📚 What's Included" >> $GITHUB_STEP_SUMMARY
+          echo "- Getting Started Guide" >> $GITHUB_STEP_SUMMARY
+          echo "- Complete README" >> $GITHUB_STEP_SUMMARY
+          echo "- API Documentation" >> $GITHUB_STEP_SUMMARY
+          echo "- Database Schema" >> $GITHUB_STEP_SUMMARY
+          echo "- Import Guide" >> $GITHUB_STEP_SUMMARY
+          echo "- Contributing Guidelines" >> $GITHUB_STEP_SUMMARY

.github/workflows/propagate-changes.yml

@@ -0,0 +1,106 @@
+name: Propagate Changes Between Branches
+
+on:
+  push:
+    branches:
+      - main
+      - development
+
+permissions:
+  contents: write
+  pull-requests: write
+
+jobs:
+  propagate:
+    name: Create PR to synchronize branches
+    runs-on: ubuntu-latest
+    if: github.actor != 'github-actions[bot]' && github.event.pusher != null
+    steps:
+      - name: Set up Node (for github-script)
+        uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5
+        with:
+          node-version: '20.19.5'
+
+      - name: Propagate Changes
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
+        with:
+          script: |
+            const currentBranch = context.ref.replace('refs/heads/', '');
+
+            async function createPR(src, base) {
+              if (src === base) return;
+
+              core.info(`Checking propagation from ${src} to ${base}...`);
+
+              // Check for existing open PRs
+              const { data: pulls } = await github.rest.pulls.list({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                state: 'open',
+                head: `${context.repo.owner}:${src}`,
+                base: base,
+              });
+
+              if (pulls.length > 0) {
+                core.info(`Existing PR found for ${src} -> ${base}. Skipping.`);
+                return;
+              }
+
+              // Compare commits to see if src is ahead of base
+              try {
+                const compare = await github.rest.repos.compareCommits({
+                  owner: context.repo.owner,
+                  repo: context.repo.repo,
+                  base: base,
+                  head: src,
+                });
+
+                // If src is not ahead, nothing to merge
+                if (compare.data.ahead_by === 0) {
+                  core.info(`${src} is not ahead of ${base}. No propagation needed.`);
+                  return;
+                }
+              } catch (error) {
+                // If base branch doesn't exist, etc.
+                core.warning(`Error comparing ${src} to ${base}: ${error.message}`);
+                return;
+              }
+
+              // Create PR
+              try {
+                const pr = await github.rest.pulls.create({
+                  owner: context.repo.owner,
+                  repo: context.repo.repo,
+                  title: `Propagate changes from ${src} into ${base}`,
+                  head: src,
+                  base: base,
+                  body: `Automated PR to propagate changes from ${src} into ${base}.\n\nTriggered by push to ${currentBranch}.`,
+                });
+                core.info(`Created PR #${pr.data.number} to merge ${src} into ${base}`);
+              } catch (error) {
+                core.warning(`Failed to create PR from ${src} to ${base}: ${error.message}`);
+              }
+            }
+
+            if (currentBranch === 'main') {
+              // Main -> Development
+              await createPR('main', 'development');
+            } else if (currentBranch === 'development') {
+              // Development -> Feature branches
+              const branches = await github.paginate(github.rest.repos.listBranches, {
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+              });
+
+              const featureBranches = branches
+                .map(b => b.name)
+                .filter(name => name.startsWith('feature/'));
+
+              core.info(`Found ${featureBranches.length} feature branches: ${featureBranches.join(', ')}`);
+
+              for (const featureBranch of featureBranches) {
+                await createPR('development', featureBranch);
+              }
+            }
+        env:
+          GITHUB_TOKEN: ${{ secrets.PROJECT_TOKEN }}

.github/workflows/quality-checks.yml

@@ -0,0 +1,58 @@
+name: Quality Checks
+
+on:
+  push:
+    branches: [ main, development, 'feature/**' ]
+  pull_request:
+    branches: [ main, development ]
+
+jobs:
+  backend-quality:
+    name: Backend (Go)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
+
+      - name: Set up Go
+        uses: actions/setup-go@44694675825211faa026b3c33043df3e48a5fa00 # v6.0.0
+        with:
+          go-version: '1.24.4'
+          cache-dependency-path: backend/go.sum
+
+      - name: Run Go tests
+        working-directory: backend
+        run: go test -v ./...
+
+      - name: Run golangci-lint
+        uses: golangci/golangci-lint-action@d6238b002a20823d52840fda27e2d4891c5952dc # v4.0.1
+        with:
+          version: latest
+          working-directory: backend
+          args: --timeout=5m
+        continue-on-error: true
+
+  frontend-quality:
+    name: Frontend (React)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
+
+      - name: Set up Node.js
+        uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0
+        with:
+          node-version: '20.19.5'
+          cache: 'npm'
+          cache-dependency-path: frontend/package-lock.json
+
+      - name: Install dependencies
+        working-directory: frontend
+        run: npm ci
+
+      - name: Run frontend tests
+        working-directory: frontend
+        run: npm test
+
+      - name: Run frontend lint
+        working-directory: frontend
+        run: npm run lint
+        continue-on-error: true

.github/workflows/release.yml

@@ -0,0 +1,52 @@
+name: Release
+
+on:
+  push:
+    tags:
+      - 'v*.*.*'
+
+permissions:
+  contents: write
+  packages: write
+
+jobs:
+  create-release:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
+        with:
+          fetch-depth: 0
+
+      - name: Generate changelog
+        id: changelog
+        run: |
+          # Get previous tag
+          PREV_TAG=$(git describe --tags --abbrev=0 $(git rev-list --tags --skip=1 --max-count=1) 2>/dev/null || echo "")
+
+          if [ -z "$PREV_TAG" ]; then
+            echo "First release - generating full changelog"
+            CHANGELOG=$(git log --pretty=format:"- %s (%h)" --no-merges)
+          else
+            echo "Generating changelog since $PREV_TAG"
+            CHANGELOG=$(git log $PREV_TAG..HEAD --pretty=format:"- %s (%h)" --no-merges)
+          fi
+
+          # Save to file for GitHub release
+          echo "$CHANGELOG" > CHANGELOG.txt
+          echo "Generated changelog with $(echo "$CHANGELOG" | wc -l) commits"
+
+      - name: Create GitHub Release
+        uses: softprops/action-gh-release@de2c0eb89ae2a093876385947365aca7b0e5f844 # v1
+        with:
+          body_path: CHANGELOG.txt
+          generate_release_notes: true
+          draft: false
+          prerelease: ${{ contains(github.ref_name, 'alpha') || contains(github.ref_name, 'beta') || contains(github.ref_name, 'rc') }}
+        env:
+          GITHUB_TOKEN: ${{ secrets.PROJECT_TOKEN }}
+
+  build-and-publish:
+    needs: create-release
+    uses: ./.github/workflows/docker-publish.yml
+    secrets: inherit

.github/workflows/renovate.yml

@@ -0,0 +1,27 @@
+name: Renovate
+
+on:
+  schedule:
+    - cron: '0 5 * * *' # daily 05:00 EST
+  workflow_dispatch:
+
+permissions:
+  contents: write
+  pull-requests: write
+  issues: write
+
+jobs:
+  renovate:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
+        with:
+          fetch-depth: 1
+      - name: Run Renovate
+        uses: renovatebot/github-action@0984fb80fc633b17e57f3e8b6c007fe0dc3e0d62 # v40.3.6
+        with:
+          configurationFile: .github/renovate.json
+          token: ${{ secrets.PROJECT_TOKEN }}
+        env:
+          LOG_LEVEL: info