Workflows/ci/bff

[golkity]

Description

This PR introduces the foundational Continuous Integration (CI) pipeline for the BFF service. It sets up an automated workflow to ensure code quality, security, and test coverage before merging into the dev and master branches.

Pipeline Stages

The workflow consists of four primary jobs:

• Code Quality: Enforces formatting (cargo fmt) and strict linting (clippy). Includes protoc installation to ensure gRPC schemas compile correctly.
• Security Audit: Scans the dependency tree for known vulnerabilities using cargo audit.
• Test & Coverage: Runs unit and integration tests via cargo llvm-cov.
• Docker Build & Scan: Builds the Docker image and performs a vulnerability scan (OS and libraries) using Trivy, targeting CRITICAL and HIGH severities.

Important

This pipeline enforces strict quality gates. It is configured to fail the build if clippy throws any warnings (-D warnings) or if the test code coverage falls below the 80% threshold.

Note

To optimize GitHub Actions minutes, the workflow uses path filters. It will only trigger if changes are detected within backend/service/bff_service/**, backend/libs/rust-core/**, or backend/proto/**.

Tip

Once this PR is merged, it is highly recommended to update the Branch Protection Rules for the dev branch to require this CI workflow to pass successfully before any future pull requests can be merged.