Reduce warnings and bump CI deps

.github/copilot-instructions.md

@@ -37,6 +37,8 @@
 - Ensure smoke tests are available for all private and public APIs
 - Ensure all tests (both frontend and backend) are run in a consistent environment (e.g. using Docker)
 - Ensure all tests (both frontend and backend) are run at every pull request creation or update
+- Never reduce the test coverage of any existing code, even if the code is being refactored or rewritten
+- Never reduce the test scope by removing any existing tests
 
 ## Security considerations
 

.github/workflows/api-tests.yml

@@ -30,11 +30,11 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7.0.1
 
       # -- Python setup --------------------------------------------------------
       - name: Set up Python ${{ inputs.python-version }}
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v7
         with:
           python-version: ${{ inputs.python-version }}
           cache: pip
@@ -44,7 +44,7 @@ jobs:
 
       # -- Node setup (build frontend so FastAPI can serve static files) -------
       - name: Set up Node.js ${{ inputs.node-version }}
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v7
         with:
           node-version: ${{ inputs.node-version }}
           cache: npm

.github/workflows/docker-build.yml

@@ -10,13 +10,13 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7.0.1
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@v4.2.0
 
       - name: Build backend image
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@v7.3.0
         with:
           context: .
           file: Dockerfile.backend
@@ -27,7 +27,7 @@ jobs:
           cache-to: type=gha,scope=backend,mode=max
 
       - name: Build frontend image
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@v7.3.0
         with:
           context: .
           file: Dockerfile.frontend

.github/workflows/frontend-tests.yml

@@ -15,10 +15,10 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7.0.1
 
       - name: Set up Node.js ${{ inputs.node-version }}
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v7
         with:
           node-version: ${{ inputs.node-version }}
           cache: npm
@@ -82,15 +82,15 @@ jobs:
 
       - name: Upload JUnit test results artifact
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7.0.1
         with:
           name: frontend-junit-results-node${{ inputs.node-version }}
           path: frontend/reports/junit.xml
           retention-days: 30
 
       - name: Upload coverage report artifact
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7.0.1
         with:
           name: frontend-coverage-node${{ inputs.node-version }}
           path: frontend/coverage/

.github/workflows/pages.yml

@@ -25,7 +25,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7.0.1
 
       - name: Copy screenshots into website
         run: cp -r images/ website/images/
@@ -40,7 +40,7 @@ jobs:
           fi
 
       - name: Configure GitHub Pages
-        uses: actions/configure-pages@v5
+        uses: actions/configure-pages@v6
 
       - name: Upload Pages artifact
         uses: actions/upload-pages-artifact@v3
@@ -57,4 +57,4 @@ jobs:
     steps:
       - name: Deploy to GitHub Pages
         id: deployment
-        uses: actions/deploy-pages@v4
+        uses: actions/deploy-pages@v5

.github/workflows/release.yml

@@ -50,25 +50,25 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7.0.1
 
       - name: Compute lowercase image name
         id: image
         run: echo "name=$(echo '${{ env.REGISTRY }}/${{ github.repository }}-backend' | tr '[:upper:]' '[:lower:]')" >> "$GITHUB_OUTPUT"
 
       - name: Log in to GHCR
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4.6.0
         with:
           registry: ${{ env.REGISTRY }}
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@v4.2.0
 
       - name: Build and push digest (amd64)
         id: push
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@v7.3.0
         with:
           context: .
           file: Dockerfile.backend
@@ -94,25 +94,25 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7.0.1
 
       - name: Compute lowercase image name
         id: image
         run: echo "name=$(echo '${{ env.REGISTRY }}/${{ github.repository }}-backend' | tr '[:upper:]' '[:lower:]')" >> "$GITHUB_OUTPUT"
 
       - name: Log in to GHCR
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4.6.0
         with:
           registry: ${{ env.REGISTRY }}
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@v4.2.0
 
       - name: Build and push digest (arm64)
         id: push
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@v7.3.0
         with:
           context: .
           file: Dockerfile.backend
@@ -138,25 +138,25 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7.0.1
 
       - name: Compute lowercase image name
         id: image
         run: echo "name=$(echo '${{ env.REGISTRY }}/${{ github.repository }}-frontend' | tr '[:upper:]' '[:lower:]')" >> "$GITHUB_OUTPUT"
 
       - name: Log in to GHCR
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4.6.0
         with:
           registry: ${{ env.REGISTRY }}
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@v4.2.0
 
       - name: Build and push digest (amd64)
         id: push
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@v7.3.0
         with:
           context: .
           file: Dockerfile.frontend
@@ -181,25 +181,25 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7.0.1
 
       - name: Compute lowercase image name
         id: image
         run: echo "name=$(echo '${{ env.REGISTRY }}/${{ github.repository }}-frontend' | tr '[:upper:]' '[:lower:]')" >> "$GITHUB_OUTPUT"
 
       - name: Log in to GHCR
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4.6.0
         with:
           registry: ${{ env.REGISTRY }}
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@v4.2.0
 
       - name: Build and push digest (arm64)
         id: push
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@v7.3.0
         with:
           context: .
           file: Dockerfile.frontend
@@ -220,10 +220,10 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7.0.1
 
       - name: Log in to GHCR
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4.6.0
         with:
           registry: ${{ env.REGISTRY }}
           username: ${{ github.actor }}
@@ -267,10 +267,10 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7.0.1
 
       - name: Log in to GHCR
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4.6.0
         with:
           registry: ${{ env.REGISTRY }}
           username: ${{ github.actor }}

.github/workflows/unit-tests.yml

@@ -25,10 +25,10 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7.0.1
 
       - name: Set up Python ${{ inputs.python-version }}
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v7
         with:
           python-version: ${{ inputs.python-version }}
           cache: pip
@@ -86,15 +86,15 @@ jobs:
           python3 scripts/list_endpoints.py >> "$GITHUB_STEP_SUMMARY" 2>/dev/null || python3 -m scripts.list_endpoints >> "$GITHUB_STEP_SUMMARY" 2>/dev/null || echo "Failed to enumerate endpoints" >> "$GITHUB_STEP_SUMMARY"
 
       - name: Publish JUnit test results artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7.0.1
         if: always()
         with:
           name: junit-results-py${{ inputs.python-version }}
           path: reports/junit.xml
           retention-days: 30
 
       - name: Publish coverage report artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7.0.1
         if: always()
         with:
           name: coverage-report-py${{ inputs.python-version }}

Makefile

@@ -1,4 +1,4 @@
-.PHONY: help dev build build-backend build-frontend smoke-test up down logs restart shell test test-unit test-coverage test-all
+.PHONY: help dev build build-backend build-frontend smoke-test up down logs restart shell test test-unit test-coverage test-all full-ci
 
 COMPOSE = docker compose
 
@@ -20,6 +20,7 @@ help:
 	@echo "  make test-unit        Run tests without coverage reporting (fast)"
 	@echo "  make test-coverage    Run tests and open the HTML coverage report"
 	@echo "  make test-all         Run tests for Python 3.11, 3.12, and 3.13"
+	@echo "  make full-ci          Run full test suite then build Docker images"
 	@echo ""
 
 # -- Local development (no Docker) ---------------------------------------------
@@ -96,6 +97,9 @@ test-coverage:
 	  || xdg-open reports/htmlcov/index.html 2>/dev/null \
 	  || echo "HTML report is at reports/htmlcov/index.html"
 
+# Full CI gate: tests must pass before images are built
+full-ci: test build
+
 # Matrix run across all supported Python versions (requires pyenv or similar)
 test-all:
 	@for py in python3.11 python3.12 python3.13; do \