feat: set up basic ci for frontend

.github/workflows/ci-frontend.yml

@@ -0,0 +1,86 @@
+name: CI Frontend
+
+on:
+  workflow_dispatch:
+  pull_request:
+    types:
+      - opened
+      - synchronize
+      - reopened
+      - ready_for_review
+    branches:
+      - main
+      - develop
+
+jobs:
+  checks:
+    name: Frontend checks
+    timeout-minutes: 15
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: frontend
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup Node.js environment
+        uses: actions/setup-node@v4
+        with:
+          node-version-file: '.nvmrc'
+
+      - name: Restore cache
+        uses: actions/cache@v4
+        with:
+          path: |
+            .next/cache
+          key: ${{ runner.os }}-nextjs-${{ hashFiles('**/package-lock.json', '**/yarn.lock') }}-${{ hashFiles('**.[jt]s', '**.[jt]sx') }}
+          restore-keys: |
+            ${{ runner.os }}-nextjs-${{ hashFiles('**/package-lock.json', '**/yarn.lock') }}-
+
+      - name: Install dependencies
+        run: yarn
+
+      - name: Build with Next.js
+        run: yarn build
+
+      - name: Test
+        run: yarn test
+
+      - name: Lint
+        run: yarn lint
+
+      - name: Type check
+        run: yarn compile
+
+      - name: Audit dependencies
+        run: yarn audit --severity high --environment production
+
+  semgrep:
+    name: Semgrep
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: frontend
+    container:
+      image: returntocorp/semgrep:1.75
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Run Semgrep checks
+        env:
+          SEMGREP_TIMEOUT: 300
+          SEMGREP_SEND_METRICS: off
+          SEMGREP_RULES: >-
+            p/react
+            p/typescript
+            p/javascript
+            p/owasp-top-ten
+            p/secrets
+            p/security-audit
+            p/nodejsscan
+        run: |
+          semgrep scan --error --jobs 2 --disable-version-check --exclude yarn.lock

frontend/package.json

@@ -3,6 +3,7 @@
   "version": "0.1.0",
   "private": true,
   "scripts": {
+    "compile": "tsc --noEmit",
     "dev": "next dev",
     "build": "next build",
     "start": "next start",