feat: initial repository setup with complete configuration

[kevalyq]

🎯 Objective

Initial setup of the frontend repository according to SecPal standards.

✅ Changes Implemented

Base Configuration

• ✅ package.json with complete metadata (name, version, description, keywords, homepage, bugs, repository, license, author)
• ✅ REUSE.toml for REUSE 3.3 compliance
• ✅ .gitignore (Node.js/React-specific with secrets protection)
• ✅ Prettier configuration (.prettierrc.json, .prettierignore)
• ✅ Markdownlint configuration (.markdownlint.json, .markdownlintignore)
• ✅ LICENSE (AGPL-3.0-or-later)
• ✅ CHANGELOG.md
• ✅ README.md with complete documentation

TypeScript/React Setup

• ✅ tsconfig.json with Strict Mode and path aliases (@/*)
• ✅ tsconfig.node.json for build tools
• ✅ vite.config.ts with Vitest configuration
• ✅ src/main.tsx (entry point)
• ✅ src/App.tsx (root component)
• ✅ src/App.test.tsx (example test with TDD pattern)
• ✅ src/index.css (base styles)
• ✅ index.html (HTML template)
• ✅ tests/setup.ts (Vitest setup)

Scripts

• ✅ scripts/preflight.sh - Pre-push validation
• ✅ scripts/setup-pre-commit.sh - Git hooks setup

⚠️ IMPORTANT: Manual Follow-up Required

1. Create Symlinks (DRY Principle - MANDATORY)

IMPORTANT: These files MUST NOT be duplicated! They MUST be created as symlinks:

cd ~/code/SecPal/frontend

# Governance files (symlinks to .github repo)
ln -sf ../.github/CONTRIBUTING.md .
ln -sf ../.github/SECURITY.md .
ln -sf ../.github/CODE_OF_CONDUCT.md .
ln -sf ../.github/CODEOWNERS .
ln -sf ../.github/.editorconfig .editorconfig
ln -sf ../.github/.gitattributes .gitattributes

# Verify
file CONTRIBUTING.md  # Should show: symbolic link

2. Add GitHub Workflows

The following workflows need to be created (.github/workflows/):

.github/workflows/reuse.yml

# SPDX-FileCopyrightText: 2025 SecPal
# SPDX-License-Identifier: AGPL-3.0-or-later

name: REUSE Compliance

on:
  pull_request:
    branches:
      - main
  push:
    branches:
      - main

permissions:
  contents: read

jobs:
  reuse:
    name: Check REUSE Compliance
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@v5

      - name: REUSE Compliance Check
        uses: fsfe/reuse-action@v6

.github/workflows/license-compatibility.yml

See: SecPal/.github/.github/workflows/license-compatibility.yml

.github/workflows/quality.yml

# SPDX-FileCopyrightText: 2025 SecPal
# SPDX-License-Identifier: AGPL-3.0-or-later

name: Quality Gates

on:
  pull_request:
    branches:
      - main
  push:
    branches:
      - main

permissions:
  contents: read

jobs:
  formatting:
    name: Formatting Check
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@v5

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: "20"
          cache: "npm"

      - name: Install dependencies
        run: npm ci

      - name: Check formatting with Prettier
        run: npm run format:check

      - name: Lint Markdown
        run: npx markdownlint-cli2 "**/*.md"

  lint:
    name: ESLint
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@v5

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: "20"
          cache: "npm"

      - name: Install dependencies
        run: npm ci

      - name: Run ESLint
        run: npm run lint

  typecheck:
    name: TypeScript Check
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@v5

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: "20"
          cache: "npm"

      - name: Install dependencies
        run: npm ci

      - name: Run TypeScript type checking
        run: npm run typecheck

  test:
    name: Vitest Tests
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@v5

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: "20"
          cache: "npm"

      - name: Install dependencies
        run: npm ci

      - name: Run tests
        run: npm test

      - name: Generate coverage report
        run: npm run test:coverage

3. Create LICENSES/ Directory

mkdir -p LICENSES
cp ../.github/LICENSES/AGPL-3.0-or-later.txt LICENSES/
cp ../.github/LICENSES/CC0-1.0.txt LICENSES/
cp ../.github/LICENSES/MIT.txt LICENSES/

4. Configure Repository Settings (CRITICAL)

Branch Protection Rules (main)

gh api repos/SecPal/frontend/branches/main/protection \
  --method PUT \
  --field required_status_checks='{"strict":true,"contexts":["Check REUSE Compliance","Formatting Check","ESLint","TypeScript Check","Vitest Tests","Check License Compatibility"]}' \
  --field enforce_admins=true \
  --field required_pull_request_reviews='{"required_approving_review_count":0,"require_code_owner_reviews":false}' \
  --field required_linear_history=true \
  --field allow_force_pushes=false \
  --field allow_deletions=false \
  --field required_conversation_resolution=true \
  --field restrictions=null

Repository Settings

• ✅ Squash Merge Only: Settings → General → Pull Requests → Allow squash merging (disable merge commits and rebase)
• ✅ Auto-delete Branches: Settings → General → Pull Requests → Automatically delete head branches
• ✅ Require signed commits: Settings → Branches → Branch protection → Require signed commits
• ✅ Secret Scanning: Settings → Security → Code security → Enable secret scanning
• ✅ Push Protection: Settings → Security → Code security → Enable push protection
• ✅ Dependabot: Settings → Security → Code security → Enable Dependabot alerts, security updates, and version updates

Dependabot Configuration

Create .github/dependabot.yml:

# SPDX-FileCopyrightText: 2025 SecPal
# SPDX-License-Identifier: CC0-1.0

version: 2
updates:
  - package-ecosystem: "npm"
    directory: "/"
    schedule:
      interval: "daily"
      time: "04:00"
      timezone: "Europe/Berlin"
    open-pull-requests-limit: 10
    reviewers:
      - "SecPal/maintainers"
    labels:
      - "dependencies"
      - "dependabot"

  - package-ecosystem: "github-actions"
    directory: "/"
    schedule:
      interval: "weekly"
      day: "monday"
      time: "04:00"
      timezone: "Europe/Berlin"
    open-pull-requests-limit: 5
    reviewers:
      - "SecPal/maintainers"
    labels:
      - "dependencies"
      - "dependabot"
      - "github-actions"

5. Create .github/copilot-instructions.md

Copy content from SecPal/.github/.github/instructions/frontend.instructions.md to .github/copilot-instructions.md

6. Create ESLint Configuration

File eslint.config.js:

// SPDX-FileCopyrightText: 2025 SecPal
// SPDX-License-Identifier: CC0-1.0

import js from "@eslint/js";
import globals from "globals";
import reactHooks from "eslint-plugin-react-hooks";
import reactRefresh from "eslint-plugin-react-refresh";
import tseslint from "typescript-eslint";

export default tseslint.config(
  { ignores: ["dist"] },
  {
    extends: [js.configs.recommended, ...tseslint.configs.recommended],
    files: ["**/*.{ts,tsx}"],
    languageOptions: {
      ecmaVersion: 2020,
      globals: globals.browser,
    },
    plugins: {
      "react-hooks": reactHooks,
      "react-refresh": reactRefresh,
    },
    rules: {
      ...reactHooks.configs.recommended.rules,
      "react-refresh/only-export-components": [
        "warn",
        { allowConstantExport: true },
      ],
    },
  }
);

📝 Checklists

✅ Pre-Merge Checklist

• package.json with complete metadata
• REUSE.toml configured
• README.md complete
• CHANGELOG.md created
• TypeScript Strict Mode enabled
• Vitest tests present
• Preflight script created
• Pre-commit hook script created
• Symlinks created (MUST be done locally!)
• LICENSES/ directory created
• GitHub Workflows added
• Branch Protection configured
• Repository Settings configured
• Dependabot configured
• ESLint configured
• Copilot Instructions added

✅ Security Checklist

• .gitignore includes secrets (.env*, *.key, *.pem, secrets/, credentials/)
• Secret Scanning enabled
• Push Protection enabled
• Dependabot enabled
• Workflow permissions minimal (contents: read)

✅ Quality Gates Checklist

• REUSE Compliance
• License Compatibility Check
• Prettier Formatting
• Markdownlint
• Actionlint
• ESLint (configured)
• TypeScript Type Checking
• Vitest Tests
• PR Size Validation

🔒 Branch Protection - Confirmation

• enforce_admins: true - NON-NEGOTIABLE
• required_signatures: true - Signed commits required
• required_linear_history: true - No merge commits
• required_conversation_resolution: true - Resolve all comments
• allow_force_pushes: false - No force pushes
• allow_deletions: false - Main branch not deletable
• Required status checks configured
• Squash Merge Only

🛠️ Next Steps

1. Merge PR (after symlinks are created locally)
2. Add Workflows (new PR)
3. Enable Branch Protection
4. Configure Repository Settings
5. Enable Dependabot
6. Add ESLint Configuration
7. Add Copilot Instructions

📚 References

• SecPal Copilot Instructions
• SecPal CONTRIBUTING.md
• SecPal SECURITY.md
• REUSE 3.3 Specification

---

BREAKING CHANGE: Initial repository setup

[Copilot]

Pull Request Overview

This PR establishes the initial setup for the SecPal frontend repository, implementing a complete React/TypeScript/Vite stack with comprehensive tooling, quality gates, and REUSE 3.3 compliance.

• Complete build and development toolchain with Vite, TypeScript strict mode, and React 18
• Testing infrastructure using Vitest and React Testing Library with example tests
• Quality assurance tools including Prettier, Markdownlint, ESLint configuration, and automated pre-push validation scripts

Reviewed Changes

Copilot reviewed 19 out of 21 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
package.json	Defines project metadata, dependencies, and npm scripts for development, testing, and code quality
vite.config.ts	Configures Vite bundler with React plugin, path aliases, and Vitest test runner with coverage settings
tsconfig.node.json	TypeScript configuration for build tools (Vite) with strict mode enabled
tsconfig.json	(Not shown but referenced) TypeScript configuration for application code
src/main.tsx	Application entry point with React root rendering and error handling
src/App.tsx	Root React component displaying welcome page
src/App.test.tsx	Example component tests demonstrating TDD pattern
src/index.css	Base CSS styles with dark/light theme support
index.html	HTML template with root element and script loading
scripts/preflight.sh	Pre-push validation script running formatting, linting, type checking, tests, and PR size validation
scripts/setup-pre-commit.sh	Git hooks setup script with spike branch support
REUSE.toml	REUSE 3.3 compliance configuration defining license annotations for all file types
README.md	Comprehensive documentation covering setup, development workflow, testing, and contribution guidelines
.prettierrc.json	Prettier code formatting configuration
.prettierignore	Files excluded from Prettier formatting
.markdownlint.json	Markdown linting rules configuration
.markdownlintignore	Files excluded from Markdown linting
CHANGELOG.md	Project changelog following Keep a Changelog format
LICENSE	License reference file pointing to LICENSES/ directory

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[kevalyq]

✅ Closing PR - All changes already in main

This PR has been superseded by the work completed in Issue #2. All objectives from this PR have been successfully implemented and merged into main via subsequent PRs:

✅ Changes from PR #1 now in main:

Base Configuration:

• ✅ package.json with complete metadata
• ✅ REUSE.toml for REUSE 3.3 compliance
• ✅ .gitignore, Prettier, Markdownlint configs
• ✅ LICENSE, CHANGELOG.md, README.md

TypeScript/React Setup:

• ✅ tsconfig.json with Strict Mode
• ✅ vite.config.ts with Vitest
• ✅ src/ directory with App.tsx, App.test.tsx
• ✅ Complete build toolchain

Scripts:

• ✅ scripts/preflight.sh
• ✅ scripts/setup-pre-commit.sh

Additional items (implemented via Issue #2):

• ✅ Symlinks to governance files (CONTRIBUTING.md, SECURITY.md, etc.)
• ✅ LICENSES/ directory (3 license files)
• ✅ GitHub Workflows (REUSE, Quality, CodeQL, License Compatibility)
• ✅ Branch Protection (7 required checks, enforce_admins: true)
• ✅ Dependabot configuration
• ✅ ESLint configuration
• ✅ Copilot Instructions

Repository Status:

• ✅ Production ready
• ✅ All quality gates passing
• ✅ REUSE 3.3 compliant (29/29 files)
• ✅ Merge settings: Squash only (rebase disabled)
• ✅ All standard labels configured

Closing reason: The repository setup is complete via main branch. Merging this PR would cause conflicts with already-applied changes and is no longer necessary.

See Issue #2 for complete setup validation: #2