Enhance CI/CD pipeline with code quality, security, and release automation

.github/CODEOWNERS

@@ -0,0 +1,44 @@
+# CODEOWNERS
+# Each line is a pattern followed by one or more owners.
+# Owners are notified and required to review PRs that touch matching paths.
+# Last matching pattern takes precedence.
+
+# Default owners for everything not explicitly matched
+* @Sunbird-Knowlg/knowlg-maintainers
+
+# CI/CD and GitHub configuration — DevOps team owns all pipeline changes
+.github/ @Sunbird-Knowlg/knowlg-devops
+build/ @Sunbird-Knowlg/knowlg-devops
+knowlg-automation/ @Sunbird-Knowlg/knowlg-devops
+docker-compose.yml @Sunbird-Knowlg/knowlg-devops
+local-setup.sh @Sunbird-Knowlg/knowlg-devops
+
+# Shared platform-core — platform team
+platform-core/ @Sunbird-Knowlg/knowlg-platform
+
+# Knowledge graph engine — graph/ontology team
+ontology-engine/ @Sunbird-Knowlg/knowlg-graph
+
+# Content API — content team
+content-api/ @Sunbird-Knowlg/knowlg-content
+
+# Assessment API — assessment team
+assessment-api/ @Sunbird-Knowlg/knowlg-assessment
+
+# Taxonomy API — taxonomy team
+taxonomy-api/ @Sunbird-Knowlg/knowlg-taxonomy
+
+# Search API — search team
+search-api/ @Sunbird-Knowlg/knowlg-search
+
+# Knowlg Service — knowlg core team
+knowlg-service/ @Sunbird-Knowlg/knowlg-maintainers
+
+# Platform modules (MIME, import, URL) — platform team
+platform-modules/ @Sunbird-Knowlg/knowlg-platform
+
+# Schema definitions — requires cross-team review
+schemas/ @Sunbird-Knowlg/knowlg-maintainers
+
+# Root POM — requires broad review (affects all modules)
+pom.xml @Sunbird-Knowlg/knowlg-maintainers @Sunbird-Knowlg/knowlg-devops

.github/dependabot.yml

@@ -0,0 +1,43 @@
+version: 2
+updates:
+  # Maven dependencies
+  - package-ecosystem: "maven"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+      time: "06:00"
+    open-pull-requests-limit: 10
+    labels:
+      - "dependencies"
+      - "maven"
+    groups:
+      jackson:
+        patterns:
+          - "com.fasterxml.jackson*"
+      pekko:
+        patterns:
+          - "org.apache.pekko*"
+      logback:
+        patterns:
+          - "ch.qos.logback*"
+      netty:
+        patterns:
+          - "io.netty*"
+      scala:
+        patterns:
+          - "org.scala-lang*"
+          - "org.scalatest*"
+          - "org.scalamock*"
+
+  # GitHub Actions
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+      time: "06:00"
+    open-pull-requests-limit: 10
+    labels:
+      - "dependencies"
+      - "github-actions"

.github/pull_request_template.md

@@ -1,33 +1,37 @@
-Please include a summary of the change and which issue is fixed. Please also include relevant motivation and context. List any dependencies that are required for this change.
+## Jira Ticket
+<!-- Link the Jira ticket this PR addresses: https://project.atlassian.net/browse/KNOWLG-XXXX -->
 
-### Type of change
-
-Please choose appropriate options.
+## Summary
+<!-- Describe the change and which issue is fixed. Include motivation, context, and any dependencies required. -->
 
+## Type of Change
 - [ ] Bug fix (non-breaking change which fixes an issue)
 - [ ] New feature (non-breaking change which adds functionality)
 - [ ] Breaking change (fix or feature that would cause existing functionality to not work as expected)
-- [ ] This change requires a documentation update
-
-### How Has This Been Tested?
+- [ ] Refactoring (no functional change)
+- [ ] Documentation update
 
-Please describe the tests that you ran to verify your changes in the below checkboxes. Provide instructions so we can reproduce. Please also list any relevant details for your test configuration
+## How Has This Been Tested?
+<!-- Describe the tests run to verify your changes. Provide reproduction steps and test configuration details. -->
 
-- [ ] Ran Test A
-- [ ] Ran Test B
+- [ ] Unit tests added/updated
+- [ ] Integration tests added/updated
+- [ ] Manually tested
 
-**Test Configuration**:
-* Software versions: Java 11, scala-2.12, play-2.7.2
-* Hardware versions: 2 CPU/ 4GB RAM
+**Test Configuration:**
+- Java: 11 (Temurin)
+- Scala: 2.13.12
+- Play Framework: 3.0.5
+- Apache Pekko: 1.0.3
 
-### Checklist:
-
-- [ ] My code follows the style guidelines of this project
+## Checklist
+- [ ] My code follows the style guidelines of this project (`scalafmt` passes locally)
 - [ ] I have performed a self-review of my own code
-- [ ] I have commented my code, particularly in hard-to-understand areas
-- [ ] I have made corresponding changes to the documentation
-- [ ] My changes generate no new warnings
-- [ ] I have added tests that prove my fix is effective or that my feature works
-- [ ] New and existing unit tests pass locally with my changes
+- [ ] I have commented my code where logic is non-obvious
+- [ ] I have made corresponding changes to documentation if needed
+- [ ] My changes generate no new compiler warnings
+- [ ] I have added/updated tests that prove my fix works or my feature is correct
+- [ ] All new and existing unit tests pass locally (`mvn test -pl <module>`)
 - [ ] Any dependent changes have been merged and published in downstream modules
-
+- [ ] SonarCloud quality gate passes (check PR comment after CI completes)
+- [ ] Code coverage is maintained at or above 80%

.github/release-drafter.yml

@@ -0,0 +1,95 @@
+name-template: 'v$RESOLVED_VERSION'
+tag-template: 'v$RESOLVED_VERSION'
+
+# Semantic versioning: commits with breaking changes → major,
+# feat commits → minor, everything else → patch
+version-resolver:
+  major:
+    labels:
+      - 'breaking-change'
+      - 'major'
+  minor:
+    labels:
+      - 'feature'
+      - 'enhancement'
+  patch:
+    labels:
+      - 'bug'
+      - 'bugfix'
+      - 'fix'
+      - 'patch'
+      - 'dependencies'
+      - 'chore'
+  default: patch
+
+categories:
+  - title: 'Breaking Changes'
+    labels:
+      - 'breaking-change'
+      - 'major'
+  - title: 'New Features'
+    labels:
+      - 'feature'
+      - 'enhancement'
+  - title: 'Bug Fixes'
+    labels:
+      - 'bug'
+      - 'bugfix'
+      - 'fix'
+  - title: 'Security'
+    labels:
+      - 'security'
+  - title: 'Dependencies'
+    labels:
+      - 'dependencies'
+      - 'maven'
+      - 'github-actions'
+  - title: 'Maintenance'
+    labels:
+      - 'chore'
+      - 'refactoring'
+      - 'documentation'
+
+# Exclude PRs from bots
+exclude-labels:
+  - 'skip-changelog'
+
+# Template for the release body
+template: |
+  ## What's Changed
+
+  $CHANGES
+
+  **Full Changelog**: $PREVIOUS_TAG...v$RESOLVED_VERSION
+
+autolabeler:
+  - label: 'feature'
+    title:
+      - '/^feat(\(.+\))?:/i'
+      - '/^feature:/i'
+  - label: 'bug'
+    title:
+      - '/^fix(\(.+\))?:/i'
+      - '/^bugfix:/i'
+  - label: 'breaking-change'
+    title:
+      - '/^.+!:/i'
+    body:
+      - '/BREAKING CHANGE/i'
+  - label: 'chore'
+    title:
+      - '/^chore(\(.+\))?:/i'
+      - '/^refactor(\(.+\))?:/i'
+  - label: 'documentation'
+    title:
+      - '/^docs(\(.+\))?:/i'
+  - label: 'dependencies'
+    title:
+      - '/^(chore\(deps\)|build\(deps\)):/i'
+    branch:
+      - '/^dependabot\//i'
+  - label: 'security'
+    title:
+      - '/^security:/i'
+    body:
+      - '/CVE-\d{4}-\d+/i'