ci: implement world-class CI/CD pipeline with comprehensive quality gates

- Add unified CI workflow with quality gates for all services:
  - Rust: fmt, clippy, cargo-sort, tests, MSRV check
  - Go: gofmt, vet, staticcheck, golangci-lint, tests
  - TypeScript: Biome lint, type-check, build
  - Elixir: format, compile warnings, Credo, tests

- Optimize Docker build workflow:
  - Require quality gates to pass before building
  - Smart change detection for selective builds
  - Multi-platform support (amd64/arm64)
  - Build attestations and SBOM generation
  - Efficient caching with GitHub Actions cache

- Add comprehensive security scanning:
  - Dependency audits (cargo-audit, govulncheck, npm audit)
  - CodeQL static analysis for Go and TypeScript
  - Container scanning with Trivy
  - Secret scanning with TruffleHog and Gitleaks
  - License compliance checking

- Create release workflow:
  - Semantic versioning support
  - Multi-platform binary builds (Rust + Go)
  - Automated GitHub releases with artifacts
  - Image attestations for supply chain security

- Update Dockerfiles with best practices:
  - Multi-stage builds for minimal images
  - Non-root users for security
  - Proper signal handling with tini
  - OCI-compliant labels
  - Build args for version embedding

- Add supporting configurations:
  - Dependabot for automated updates
  - golangci-lint config for Go
  - cargo-deny config for Rust
  - PR template for consistent reviews

Author: decebal

.github/dependabot.yml

@@ -0,0 +1,148 @@
+# Dependabot configuration for automated dependency updates
+# https://docs.github.com/en/code-security/dependabot/dependabot-version-updates
+
+version: 2
+updates:
+  # GitHub Actions
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+    commit-message:
+      prefix: "ci(deps)"
+    labels:
+      - "dependencies"
+      - "ci"
+    reviewers:
+      - "all-source-os/maintainers"
+
+  # Rust (Core)
+  - package-ecosystem: "cargo"
+    directory: "/apps/core"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+    commit-message:
+      prefix: "deps(rust)"
+    labels:
+      - "dependencies"
+      - "rust"
+    ignore:
+      # Arrow/Parquet pinned to ~57.1 due to edition2024 requirements
+      - dependency-name: "arrow"
+        versions: [">=58.0.0"]
+      - dependency-name: "parquet"
+        versions: [">=58.0.0"]
+      - dependency-name: "datafusion"
+        versions: [">=52.0.0"]
+    groups:
+      rust-minor:
+        patterns:
+          - "*"
+        update-types:
+          - "minor"
+          - "patch"
+
+  # Go (Control Plane)
+  - package-ecosystem: "gomod"
+    directory: "/apps/control-plane"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+    commit-message:
+      prefix: "deps(go)"
+    labels:
+      - "dependencies"
+      - "go"
+    groups:
+      go-minor:
+        patterns:
+          - "*"
+        update-types:
+          - "minor"
+          - "patch"
+
+  # NPM/Bun (Web, packages)
+  - package-ecosystem: "npm"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+    commit-message:
+      prefix: "deps(npm)"
+    labels:
+      - "dependencies"
+      - "javascript"
+    groups:
+      npm-minor:
+        patterns:
+          - "*"
+        update-types:
+          - "minor"
+          - "patch"
+
+  # Mix (Query Service)
+  - package-ecosystem: "mix"
+    directory: "/apps/query-service"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+    commit-message:
+      prefix: "deps(elixir)"
+    labels:
+      - "dependencies"
+      - "elixir"
+
+  # Mix (MCP Server)
+  - package-ecosystem: "mix"
+    directory: "/apps/mcp-server-elixir"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+    commit-message:
+      prefix: "deps(elixir)"
+    labels:
+      - "dependencies"
+      - "elixir"
+
+  # Docker
+  - package-ecosystem: "docker"
+    directory: "/apps/core"
+    schedule:
+      interval: "weekly"
+    commit-message:
+      prefix: "deps(docker)"
+    labels:
+      - "dependencies"
+      - "docker"
+
+  - package-ecosystem: "docker"
+    directory: "/apps/control-plane"
+    schedule:
+      interval: "weekly"
+    commit-message:
+      prefix: "deps(docker)"
+    labels:
+      - "dependencies"
+      - "docker"
+
+  - package-ecosystem: "docker"
+    directory: "/apps/web"
+    schedule:
+      interval: "weekly"
+    commit-message:
+      prefix: "deps(docker)"
+    labels:
+      - "dependencies"
+      - "docker"
+
+  - package-ecosystem: "docker"
+    directory: "/apps/query-service"
+    schedule:
+      interval: "weekly"
+    commit-message:
+      prefix: "deps(docker)"
+    labels:
+      - "dependencies"
+      - "docker"

.github/pull_request_template.md

@@ -0,0 +1,53 @@
+## Description
+
+<!-- Describe your changes in detail -->
+
+## Type of Change
+
+- [ ] 🐛 Bug fix (non-breaking change which fixes an issue)
+- [ ] ✨ New feature (non-breaking change which adds functionality)
+- [ ] 💥 Breaking change (fix or feature that would cause existing functionality to change)
+- [ ] 📚 Documentation update
+- [ ] 🔧 Configuration change
+- [ ] ♻️ Refactoring (no functional changes)
+- [ ] 🧪 Test improvements
+
+## Services Affected
+
+- [ ] `core` (Rust event store)
+- [ ] `control-plane` (Go orchestration)
+- [ ] `web` (Next.js dashboard)
+- [ ] `query-service` (Elixir query layer)
+- [ ] `mcp-server` (Elixir MCP integration)
+- [ ] CI/CD / Infrastructure
+
+## Checklist
+
+### Code Quality
+- [ ] My code follows the project's style guidelines
+- [ ] I have performed a self-review of my code
+- [ ] I have commented my code where necessary
+- [ ] My changes generate no new warnings
+
+### Testing
+- [ ] I have added tests that prove my fix/feature works
+- [ ] New and existing unit tests pass locally
+- [ ] I have tested my changes on both x86 and ARM (if applicable)
+
+### Documentation
+- [ ] I have updated the README if needed
+- [ ] I have updated relevant documentation
+- [ ] I have added JSDoc/rustdoc/godoc comments for public APIs
+
+### CI/CD
+- [ ] All quality gates pass (check GitHub Actions)
+- [ ] Docker images build successfully
+- [ ] Security scans show no critical issues
+
+## Screenshots (if applicable)
+
+<!-- Add screenshots for UI changes -->
+
+## Additional Notes
+
+<!-- Any additional context or notes for reviewers -->