chore: add Github workflows

.github/CODEOWNERS

@@ -0,0 +1 @@
+*			@bluecatengineering/ui

.github/dependabot.yml

@@ -0,0 +1,17 @@
+version: 2
+updates:
+  - package-ecosystem: npm
+    directory: '/'
+    schedule:
+      interval: monthly
+    ignore:
+      - dependency-name: '*'
+        update-types: ['version-update:semver-patch']
+
+  - package-ecosystem: github-actions
+    directory: '/'
+    schedule:
+      interval: monthly
+    ignore:
+      - dependency-name: '*'
+        update-types: ['version-update:semver-patch']

.github/workflows/codeql.yaml

@@ -0,0 +1,37 @@
+name: CodeQL
+
+on:
+  push:
+    branches: [master]
+  pull_request:
+    branches: [master]
+  schedule:
+    - cron: '49 14 * * 4'
+
+permissions: read-all
+
+jobs:
+  analyze:
+    name: Analyze
+    runs-on: ubuntu-latest
+    permissions:
+      security-events: write
+
+    strategy:
+      fail-fast: false
+      matrix:
+        language: [javascript]
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # tag=v6.0.2
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@c10b8064de6f491fea524254123dbe5e09572f13 # tag=v4.35.1
+        with:
+          languages: ${{ matrix.language }}
+
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@c10b8064de6f491fea524254123dbe5e09572f13 # tag=v4.35.1
+        with:
+          category: '/language:${{matrix.language}}'

.github/workflows/eslint.yaml

@@ -0,0 +1,35 @@
+name: ESLint
+
+on:
+  push:
+    branches: ['*']
+
+permissions: read-all
+
+jobs:
+  eslint:
+    name: Run eslint scanning
+    runs-on: ubuntu-latest
+    permissions:
+      security-events: write
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # tag=v6.0.2
+
+      - name: Setup node
+        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # tag=v6.3.0
+        with:
+          node-version: 24
+
+      - name: Run ESLint
+        run: |
+          npm ci
+          npm run lint-ci
+        continue-on-error: true
+
+      - name: Upload analysis results to GitHub
+        uses: github/codeql-action/upload-sarif@c10b8064de6f491fea524254123dbe5e09572f13 # tag=v4.35.1
+        with:
+          sarif_file: build/eslint-results.sarif
+          wait-for-processing: true

.github/workflows/npm.yaml

@@ -0,0 +1,40 @@
+name: Npm
+
+on:
+  release:
+    types: [published, edited]
+
+permissions: read-all
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # tag=v6.0.2
+        with:
+          fetch-depth: 0
+          ref: ${{ github.event.release.tag_name }}
+
+      - name: Setup node
+        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # tag=v6.3.0
+        with:
+          node-version: 24
+          registry-url: 'https://registry.npmjs.org'
+
+      - name: Publish packages
+        run: |
+          npm ci
+          npx lerna run prepack
+          npx lerna publish from-package -y
+
+      - name: Upload logs
+        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # tag=v7.0.0
+        if: failure()
+        with:
+          name: lerna-debug-log
+          path: lerna-debug.log

.github/workflows/unit-tests.yaml

@@ -0,0 +1,44 @@
+name: Jest
+
+on:
+  push:
+    branches: ['*']
+
+permissions: read-all
+
+jobs:
+  test:
+    name: Test
+    runs-on: ubuntu-latest
+    permissions:
+      checks: write
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # tag=v6.0.2
+
+      - name: Setup node
+        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # tag=v6.3.0
+        with:
+          node-version: 24
+
+      - name: Run tests
+        run: |
+          npm ci
+          npx lerna run prepack
+          npm run test-ci
+        env:
+          TZ: America/Toronto
+
+      - name: Publish test report
+        uses: mikepenz/action-junit-report@bccf2e31636835cf0874589931c4116687171386 # tag=v6.4.0
+        if: always()
+        with:
+          report_paths: build/junit.xml
+
+      - name: Publish coverage report
+        uses: 5monkeys/cobertura-action@ee5787cc56634acddedc51f21c7947985531e6eb # tag=v14
+        with:
+          path: coverage/cobertura-coverage.xml
+          minimum_coverage: 100
+          fail_below_threshold: true

.gitignore

@@ -1,3 +1,4 @@
 .idea/
+build/
 coverage/
 node_modules/