feature: add CI workflow and security policy

[amitmanchella-cog]

Summary

Adds a GitHub Actions CI workflow and a security policy. Both files are new — the repo had no .github/workflows/ directory and no existing SECURITY.md.

.github/workflows/ci.yml

• Triggers on push and pull_request to master (the repo's default branch).
• actions/checkout@v4 + actions/setup-java@v4 (distribution: temurin, java-version: '8', cache: maven).
• Runs ./mvnw -B verify.
• JDK 8 was chosen because pom.xml declares <java.version>1.8</java.version> (Spring Boot parent 2.0.2.RELEASE), and build.gradle also declares sourceCompatibility = 1.8. Maven is used since the repo ships a Maven wrapper (mvnw, .mvn/wrapper); the Gradle wrapper (Gradle 4.6) is present but is not used by CI.
• mvnw is now marked executable (100644 → 100755) so ./mvnw runs on the GitHub runner without a chmod step.

SECURITY.md (new): Supported Versions table (master / 0.1.0 supported) and a Reporting a Vulnerability section pointing to GitHub Security Advisories (Security tab → "Report a vulnerability"), asking that no public issues be opened, with a 5-business-day response target.

Local verification

Ran the exact CI command locally with Temurin-equivalent OpenJDK 8 (openjdk 1.8.0_502):

JAVA_HOME=/usr/lib/jvm/java-8-openjdk-amd64 ./mvnw -B verify
...
[INFO] --- spring-boot-maven-plugin:2.0.2.RELEASE:repackage (default) @ gs-spring-boot ---
[INFO] BUILD SUCCESS

Caveat worth knowing (pre-existing, not changed here): pom.xml has <packaging>pom</packaging>, so Maven's default lifecycle does not compile src/main/java or run tests — verify only runs the Spring Boot repackage goal. The build therefore passes trivially. Switching to <packaging>jar</packaging> would make CI actually compile the sources, but that's out of scope for this PR.

Devin-Org: engineering

Link to Devin session: https://app.devin.ai/sessions/f4c21c2035fb40b3ae7ac5024903cef3
Open in Devin Desktop: https://app.devin.ai/desktop/session/f4c21c2035fb40b3ae7ac5024903cef3?variant=devin
Requested by: @amitmanchella-cog

---

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring

[devin-ai-integration]

Devin Review found 1 potential issue.

[devin-ai-integration]

🟡 CI skips application compilation and tests

./mvnw -B verify reports success without compiling application sources or running tests. The pom packaging omits both phases from Maven's default lifecycle. Broken application changes can pass CI.

Learn more

Maven binds compilation and test execution to the default lifecycle only for artifact packaging such as jar. This project declares pom packaging, which represents an aggregator or parent project and has no Java compile or test bindings. The workflow therefore validates dependency resolution and the configured Spring Boot goal, but not src/main/java or any future src/test/java files.

Example: A pull request can introduce invalid syntax in TopicController.java. The new CI job still exits successfully because Maven never invokes maven-compiler-plugin for this project.

Recommended fix: Change the project packaging to jar so ./mvnw -B verify exercises the normal Java lifecycle, or run a build command that explicitly compiles and tests the application. Verify the corrected workflow fails for an intentionally uncompilable source change.

---

Was this helpful? React with 👍 or 👎 to provide feedback.

[devin-ai-integration]

Confirmed and already called out in the PR description: <packaging>pom</packaging> is pre-existing in pom.xml, so verify only runs the Spring Boot repackage goal. Changing the packaging to jar is a build-config change outside this PR's scope (CI workflow + SECURITY.md), so I've left it as-is and flagged it to the requester as a follow-up decision.