feat(workflows): add performance benchmarking and security scans

.gitea/workflows/release.yml

@@ -1,4 +1,5 @@
-name: Release
+name: Release Workflow
+
 on:
   push:
     branches:
@@ -11,16 +12,241 @@ permissions:
   contents: read
 
 jobs:
+  verify:
+    name: "Verify Main Branch"
+    uses: ./.gitea/workflows/ci.yml
+
+  prepare-release:
+    name: "Prepare Release"
+    needs: verify
+    steps:
+      - name: "Checkout"
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      
+      - name: "Setup Node.js"
+        uses: actions/setup-node@v4
+        with:
+          node-version: 20
+          cache: 'npm'
+      
+      - name: "Cache npm dependencies"
+        uses: actions/cache@v4
+        with:
+          path: ~/.npm
+          key: ${{ runner.os }}-npm-${{ hashFiles('**/package-lock.json') }}
+          restore-keys: |
+            ${{ runner.os }}-npm-
+            
+      - name: "Install dependencies"
+        run: npm ci
+      
+      - name: "Generate Release Notes"
+        id: release-notes
+        run: |
+          LATEST_TAG=$(git describe --tags --abbrev=0 2>/dev/null || echo "v0.0.0")
+          
+          echo "### Changes since $LATEST_TAG" > release-notes.md
+          echo "" >> release-notes.md
+          
+          # Add category headers
+          echo "#### 🚀 Features" >> release-notes.md
+          git log $LATEST_TAG..HEAD --pretty=format:"- %s (%h)" --grep="^feat" >> release-notes.md
+          echo "" >> release-notes.md
+          echo "" >> release-notes.md
+          
+          echo "#### 🐛 Bug Fixes" >> release-notes.md
+          git log $LATEST_TAG..HEAD --pretty=format:"- %s (%h)" --grep="^fix" >> release-notes.md
+          echo "" >> release-notes.md
+          echo "" >> release-notes.md
+          
+          echo "#### ♻️ Code Refactoring" >> release-notes.md
+          git log $LATEST_TAG..HEAD --pretty=format:"- %s (%h)" --grep="^refactor" >> release-notes.md
+          echo "" >> release-notes.md
+          echo "" >> release-notes.md
+          
+          echo "#### 🧪 Tests" >> release-notes.md
+          git log $LATEST_TAG..HEAD --pretty=format:"- %s (%h)" --grep="^test" >> release-notes.md
+          echo "" >> release-notes.md
+          echo "" >> release-notes.md
+          
+          echo "#### 📚 Documentation" >> release-notes.md
+          git log $LATEST_TAG..HEAD --pretty=format:"- %s (%h)" --grep="^docs" >> release-notes.md
+          echo "" >> release-notes.md
+          echo "" >> release-notes.md
+          
+          echo "#### 🧹 Chores" >> release-notes.md
+          git log $LATEST_TAG..HEAD --pretty=format:"- %s (%h)" --grep="^chore" >> release-notes.md
+          echo "" >> release-notes.md
+          echo "" >> release-notes.md
+          
+          echo "#### ⚙️ CI" >> release-notes.md
+          git log $LATEST_TAG..HEAD --pretty=format:"- %s (%h)" --grep="^ci" >> release-notes.md
+          echo "" >> release-notes.md
+          echo "" >> release-notes.md
+          
+          echo "#### 🔧 Build System" >> release-notes.md  
+          git log $LATEST_TAG..HEAD --pretty=format:"- %s (%h)" --grep="^build" >> release-notes.md
+          echo "" >> release-notes.md
+          echo "" >> release-notes.md
+          
+          cat release-notes.md
+          
+          # Save for next steps
+          echo "release_notes=$(cat release-notes.md | base64 -w 0)" >> $GITHUB_OUTPUT
+      
+      - name: "Upload Release Notes"
+        uses: actions/upload-artifact@v4
+        with:
+          name: release-notes
+          path: release-notes.md
+          retention-days: 7
+
   release:
-    name: Release
+    name: "Semantic Release"
+    needs: prepare-release
     permissions:
       contents: write
       issues: write 
       pull-requests: write
       id-token: write
+    outputs:
+      new_release_version: ${{ steps.semantic-release.outputs.new_release_version }}
+      new_release_published: ${{ steps.semantic-release.outputs.new_release_published }}
     steps:
-      - name: Create Release
-        uses: https://git.kjan.de/actions/semantic-release@main
+      - name: "Checkout"
+        uses: actions/checkout@v4
         with:
+          fetch-depth: 0
+      
+      - name: "Setup Node.js"
+        uses: actions/setup-node@v4
+        with:
+          node-version: 20
+          cache: 'npm'
+      
+      - name: "Install dependencies"
+        run: npm ci
+      
+      - name: "Download Release Notes"
+        uses: actions/download-artifact@v4
+        with:
+          name: release-notes
+          path: ./
+      
+      - name: "Create Release"
+        id: semantic-release
+        uses: https://git.kjan.de/actions/semantic-release@main
+        env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
+          GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
+
+  build-artifacts:
+    name: "Build Release Artifacts"
+    needs: release
+    if: ${{ needs.release.outputs.new_release_published == 'true' }}
+    steps:
+      - name: "Checkout Code"
+        uses: actions/checkout@v4
+        with:
+          ref: main
+      
+      # Backend Build
+      - name: "Setup Java"
+        uses: actions/setup-java@v4
+        with:
+          distribution: 'temurin'
+          java-version: '23'
+          cache: 'gradle'
+      
+      - name: "Build Backend"
+        working-directory: ./backend
+        run: ./gradlew bootJar --parallel --build-cache
+      
+      - name: "Upload Backend Artifact"
+        uses: actions/upload-artifact@v4
+        with:
+          name: backend-${{ needs.release.outputs.new_release_version }}
+          path: backend/build/libs/*.jar
+          retention-days: 30
+      
+      # Frontend Build
+      - name: "Install Bun"
+        uses: oven-sh/setup-bun@v2
+        with:
+          bun-version: latest
+      
+      - name: "Cache Frontend Dependencies"
+        uses: actions/cache@v4
+        with:
+          path: frontend/node_modules
+          key: ${{ runner.os }}-bun-${{ hashFiles('frontend/bun.lock') }}
+          restore-keys: |
+            ${{ runner.os }}-bun-
+      
+      - name: "Install Frontend Dependencies"
+        working-directory: ./frontend
+        run: bun install --frozen-lockfile
+      
+      - name: "Build Frontend"
+        working-directory: ./frontend
+        run: bun run build --configuration production
+      
+      - name: "Archive Frontend Build"
+        run: tar -czf frontend-${{ needs.release.outputs.new_release_version }}.tar.gz -C frontend/dist .
+      
+      - name: "Upload Frontend Artifact"
+        uses: actions/upload-artifact@v4
+        with:
+          name: frontend-${{ needs.release.outputs.new_release_version }}
+          path: frontend-${{ needs.release.outputs.new_release_version }}.tar.gz
+          retention-days: 30
+      
+      - name: "Attach Artifacts to Release"
+        env:
+          GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
+          VERSION: ${{ needs.release.outputs.new_release_version }}
+        run: |
+          RELEASE_ID=$(curl -s -H "Authorization: token $GITEA_TOKEN" \
+            "https://git.kjan.de/api/v1/repos/${{ github.repository }}/releases/tags/v$VERSION" | jq '.id')
+          
+          # Upload backend JAR
+          JAR_FILE=$(find backend/build/libs -name "*.jar" -type f | head -n 1)
+          JAR_NAME=$(basename $JAR_FILE)
+          
+          curl -X POST \
+            -H "Authorization: token $GITEA_TOKEN" \
+            -H "Content-Type: application/octet-stream" \
+            --data-binary @"$JAR_FILE" \
+            "https://git.kjan.de/api/v1/repos/${{ github.repository }}/releases/$RELEASE_ID/assets?name=$JAR_NAME"
+          
+          # Upload frontend archive
+          curl -X POST \
+            -H "Authorization: token $GITEA_TOKEN" \
+            -H "Content-Type: application/octet-stream" \
+            --data-binary @"frontend-$VERSION.tar.gz" \
+            "https://git.kjan.de/api/v1/repos/${{ github.repository }}/releases/$RELEASE_ID/assets?name=frontend-$VERSION.tar.gz"
+
+  notify:
+    name: "Notification"
+    needs: [release, build-artifacts]
+    if: ${{ always() && needs.release.outputs.new_release_published == 'true' }}
+    steps:
+      - name: "Post Release Summary"
+        run: |
+          VERSION="${{ needs.release.outputs.new_release_version }}"
+          
+          echo "### Release v$VERSION Successfully Published! 🎉" >> $GITHUB_STEP_SUMMARY
+          echo "" >> $GITHUB_STEP_SUMMARY
+          echo "✅ Semantic versioning completed" >> $GITHUB_STEP_SUMMARY
+          echo "✅ Release notes generated" >> $GITHUB_STEP_SUMMARY
+          echo "✅ Tags and GitHub Release created" >> $GITHUB_STEP_SUMMARY
+          echo "✅ Build artifacts attached to release" >> $GITHUB_STEP_SUMMARY
+          echo "" >> $GITHUB_STEP_SUMMARY
+          echo "👉 [View Release](https://git.kjan.de/${{ github.repository }}/releases/tag/v$VERSION)" >> $GITHUB_STEP_SUMMARY
+          
+          if [[ ${{ always() && needs.build-artifacts.result != 'success' }} == 'true' ]]; then
+            echo "" >> $GITHUB_STEP_SUMMARY
+            echo "⚠️ **Warning:** There was an issue with artifact building. Please check the logs." >> $GITHUB_STEP_SUMMARY
+          fi