chore(repo): rework github pipelines

.github/workflows/auto-label-pr.yml

@@ -1,65 +1,71 @@
-name: Auto-label PR
+name: Auto Label PR
 
 on:
   pull_request:
-    types: [opened, edited, synchronize]
+    types: [opened, edited, synchronize, reopened]
 
 permissions:
-  pull-requests: write
+  contents: read
+  pull-requests: read
   issues: write
 
 jobs:
   auto-label:
-    name: Apply area and type labels
+    name: auto-label
     runs-on: ubuntu-latest
+    timeout-minutes: 5
 
     steps:
-      - name: Parse title and apply labels
+      - name: Apply labels
         uses: actions/github-script@v7
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}
           script: |
             const pr = context.payload.pull_request;
-            const title    = pr.title;
+            const owner = context.repo.owner;
+            const repo = context.repo.repo;
             const prNumber = pr.number;
-            const owner    = context.repo.owner;
-            const repo     = context.repo.repo;
+            const title = pr.title || "";
 
-            const titleRegex = /^(feat|fix|docs|chore|refactor|test|style|perf)\((app|backend|ml-worker|repo)\): .{10,}$/;
-            const match = titleRegex.exec(title);
+            const typeMatch = /^(feat|fix|docs|chore|refactor|test|style|perf)\((app|backend|ml-worker|repo|shared)\):\s+.{10,}$/i.exec(title);
+            const labels = new Set();
 
-            // If the title doesn't match the convention, skip labeling silently.
-            // The pr-validator workflow handles invalid PRs.
-            if (!match) {
-              console.log("Title does not match convention — skipping auto-label.");
-              return;
+            if (typeMatch) {
+              labels.add(`type:${typeMatch[1].toLowerCase()}`);
+              const scope = typeMatch[2].toLowerCase();
+              labels.add(scope === "shared" ? "area:repo" : `area:${scope}`);
             }
 
-            const type  = match[1];  // e.g. "feat"
-            const scope = match[2];  // e.g. "app"
+            const files = await github.paginate(github.rest.pulls.listFiles, {
+              owner,
+              repo,
+              pull_number: prNumber,
+              per_page: 100,
+            });
 
-            const scopeToArea = {
-              "app":       "area:app",
-              "backend":   "area:backend",
-              "ml-worker": "area:ml-worker",
-              "repo":      "area:repo",
-            };
-
-            const labelsToApply = [
-              `type:${type}`,
-              scopeToArea[scope],
-            ].filter(Boolean);
+            for (const file of files) {
+              if (file.filename.startsWith("app/")) labels.add("area:app");
+              if (file.filename.startsWith("backend/")) labels.add("area:backend");
+              if (file.filename.startsWith("ml-worker/")) labels.add("area:ml-worker");
+              if (
+                file.filename.startsWith(".github/") ||
+                file.filename === "README.md" ||
+                file.filename.startsWith("docs/")
+              ) {
+                labels.add("area:repo");
+              }
+            }
 
-            for (const name of labelsToApply) {
+            for (const name of labels) {
               try {
                 await github.rest.issues.addLabels({
-                  owner, repo,
+                  owner,
+                  repo,
                   issue_number: prNumber,
                   labels: [name],
                 });
-                console.log(`✅ Applied label: ${name}`);
-              } catch (e) {
-                // Label may not exist in the repo yet (e.g., setup-labels not run)
-                core.warning(`Could not apply label "${name}": ${e.message}`);
+                console.log(`Applied label: ${name}`);
+              } catch (error) {
+                core.warning(`Could not apply label "${name}": ${error.message}`);
               }
             }

.github/workflows/ci-app.yml

@@ -1,16 +1,36 @@
-name: CI — App
+name: CI App
 
 on:
   pull_request:
     branches:
       - main
     paths:
+      - ".github/workflows/ci-app.yml"
       - "app/**"
+  push:
+    branches:
+      - main
+    paths:
+      - ".github/workflows/ci-app.yml"
+      - "app/**"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ci-app-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
 
 jobs:
-  app-lint:
-    name: app-lint
+  app:
+    name: app
     runs-on: ubuntu-latest
+    timeout-minutes: 15
+
+    defaults:
+      run:
+        working-directory: app
 
     steps:
       - name: Check out repository
@@ -20,36 +40,17 @@ jobs:
         uses: actions/setup-node@v4
         with:
           node-version: "20"
-          cache: "npm"
+          cache: npm
           cache-dependency-path: app/package-lock.json
 
       - name: Install dependencies
-        working-directory: app
         run: npm ci
 
-      - name: Run ESLint
-        working-directory: app
+      - name: Check JavaScript syntax
         run: npm run lint
 
-  app-type-check:
-    name: app-type-check
-    runs-on: ubuntu-latest
-
-    steps:
-      - name: Check out repository
-        uses: actions/checkout@v4
-
-      - name: Set up Node.js
-        uses: actions/setup-node@v4
-        with:
-          node-version: "20"
-          cache: "npm"
-          cache-dependency-path: app/package-lock.json
-
-      - name: Install dependencies
-        working-directory: app
-        run: npm ci
+      - name: Run TypeScript compiler
+        run: npm run typecheck
 
-      - name: TypeScript type check
-        working-directory: app
-        run: npx tsc --noEmit
+      - name: Build web bundle
+        run: npm run build:web

.github/workflows/ci-backend.yml

@@ -1,35 +1,48 @@
-name: CI — Backend
+name: CI Backend
 
 on:
   pull_request:
     branches:
       - main
     paths:
+      - ".github/workflows/ci-backend.yml"
       - "backend/**"
+  push:
+    branches:
+      - main
+    paths:
+      - ".github/workflows/ci-backend.yml"
+      - "backend/**"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ci-backend-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
 
 jobs:
-  backend-build-test:
-    name: backend-build-test
+  backend:
+    name: backend
     runs-on: ubuntu-latest
+    timeout-minutes: 20
+
+    defaults:
+      run:
+        working-directory: backend
 
     steps:
       - name: Check out repository
         uses: actions/checkout@v4
 
-      - name: Set up Java 17
+      - name: Set up Java
         uses: actions/setup-java@v4
         with:
           java-version: "17"
-          distribution: "temurin"
+          distribution: temurin
+          cache: maven
+          cache-dependency-path: backend/pom.xml
 
-      - name: Cache Maven dependencies
-        uses: actions/cache@v4
-        with:
-          path: ~/.m2/repository
-          key: ${{ runner.os }}-maven-${{ hashFiles('backend/pom.xml') }}
-          restore-keys: |
-            ${{ runner.os }}-maven-
-
-      - name: Build and test with Maven
-        working-directory: backend
-        run: mvn verify
+      - name: Verify backend
+        run: mvn -B verify

.github/workflows/ci-ml-worker.yml

@@ -1,41 +1,43 @@
-name: CI — ML Worker
+name: CI ML Worker
 
 on:
   pull_request:
     branches:
       - main
     paths:
+      - ".github/workflows/ci-ml-worker.yml"
       - "ml-worker/**"
+  push:
+    branches:
+      - main
+    paths:
+      - ".github/workflows/ci-ml-worker.yml"
+      - "ml-worker/**"
+  workflow_dispatch:
 
-jobs:
-  ml-lint:
-    name: ml-lint
-    runs-on: ubuntu-latest
+permissions:
+  contents: read
 
-    steps:
-      - name: Check out repository
-        uses: actions/checkout@v4
+concurrency:
+  group: ci-ml-worker-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
 
-      - name: Set up Python
-        uses: actions/setup-python@v5
-        with:
-          python-version: "3.11"
+jobs:
+  ml-worker:
+    name: python-${{ matrix.python-version }}
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
 
-      - name: Install dependencies
-        working-directory: ml-worker
-        run: python -m pip install -e ".[dev]"
+    strategy:
+      fail-fast: false
+      matrix:
+        python-version:
+          - "3.11"
+          - "3.12"
 
-      - name: Run flake8
+    defaults:
+      run:
         working-directory: ml-worker
-        run: flake8 .
-
-      - name: Run black (check mode)
-        working-directory: ml-worker
-        run: black --check .
-
-  ml-test:
-    name: ml-test
-    runs-on: ubuntu-latest
 
     steps:
       - name: Check out repository
@@ -44,12 +46,14 @@ jobs:
       - name: Set up Python
         uses: actions/setup-python@v5
         with:
-          python-version: "3.11"
+          python-version: ${{ matrix.python-version }}
+          cache: pip
+          cache-dependency-path: |
+            ml-worker/pyproject.toml
+            ml-worker/requirements*.txt
 
       - name: Install dependencies
-        working-directory: ml-worker
         run: python -m pip install -e ".[dev]"
 
-      - name: Run pytest with coverage
-        working-directory: ml-worker
-        run: pytest --cov=ml_worker --cov-report=xml
+      - name: Run tests
+        run: pytest