Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/run-ci-cd.yaml:
- Around line 136-142: The CI step currently runs migrations and backgrounds
gunicorn in one shell line (cd backend && poetry run python manage.py migrate &&
poetry run gunicorn wsgi:application --bind 0.0.0.0:9000 &), which can hide
gunicorn startup failures; split this into two steps or add explicit error
checks: run poetry run python manage.py migrate in its own step, then start
gunicorn in a separate step (or start it and then verify it started by checking
the process or probing the port), and ensure failures from poetry run gunicorn
wsgi:application or a health check cause the job to fail; reference the
manage.py migrate invocation and the gunicorn wsgi:application startup when
making the change.

In @.github/workflows/setup-backend-environment/action.yaml:
- Around line 29-34: Update the GitHub Action step with id "cache-poetry-venv"
(named "Cache Poetry virtual environment") to use the v5 release of
actions/cache instead of actions/cache@v3; replace the uses value
"actions/cache@v3" with either the v5 tag "actions/cache@v5" or the commit pin
"actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae" to match other
workflows and ensure consistency and security.

---

Outside diff comments:
In @.github/workflows/setup-backend-environment/action.yaml:
- Around line 3-5: Update the description field in the GitHub Action YAML (the
description: block) to remove the phrase about "builds the backend test image"
and instead state that the action sets up the backend environment, fetches
nest.dump, waits for Postgres, and installs the PostgreSQL client — i.e., edit
the description value to reflect the removed Docker build step and the current
responsibilities of the action.

---

Duplicate comments:
In @.github/workflows/run-fuzz-tests.yaml:
- Around line 54-61: The backgrounded gunicorn launch ("poetry run gunicorn
wsgi:application --bind 0.0.0.0:9500 &" in the "Run backend with fuzz
environment variables" step) can silently fail; change the step to capture the
gunicorn PID after backgrounding, immediately verify the process is alive (e.g.,
using kill -0 or checking the PID) and if it exited, fail the step (exit
non‑zero) before proceeding to the existing health check (the block that follows
the current gunicorn start). Ensure the fix references the exact command string
"poetry run gunicorn wsgi:application --bind 0.0.0.0:9500 &" and the health
check block so the script both starts gunicorn and verifies it didn't exit
prematurely.

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name=".github/workflows/setup-backend-environment/action.yaml">

<violation number="1" location=".github/workflows/setup-backend-environment/action.yaml:31">
P1: Pin `actions/cache` to an immutable commit SHA instead of the mutable `@v3` tag to avoid unreviewed action code changes in CI.</violation>

<violation number="2" location=".github/workflows/setup-backend-environment/action.yaml:34">
P2: Include Python version in the venv cache key to prevent restoring virtualenvs built with a different interpreter.</violation>
</file>

<file name=".github/workflows/run-ci-cd.yaml">

<violation number="1" location=".github/workflows/run-ci-cd.yaml:142">
P2: The trailing `&` backgrounds the entire `cd && migrate && gunicorn` chain, so migration failures won’t fail this step directly. Run migration in the foreground, then background only Gunicorn.</violation>
</file>

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/run-fuzz-tests.yaml:
- Around line 57-67: Remove the redundant and risky activation step in the "Run
fuzz tests" job: delete the `eval $(poetry env activate)` invocation so the
workflow simply changes directory to backend and runs the entrypoint script;
keep the rest of the environment setup (TEST_FILE/REST_URL/BASE_URL/CI) intact
because backend/entrypoint.fuzz.sh already uses `poetry run pytest` to execute
tests in the Poetry-managed environment.

In @.github/workflows/setup-backend-environment/action.yaml:
- Around line 39-44: The cache key for the "cache-poetry-venv" step doesn't
include the Python version, so add the Python version to the key (e.g. change
key to include either ${{ matrix.python-version }} or ${{
steps.setup-python.outputs.python-version }}), ensuring the cache step id
"cache-poetry-venv" still targets path "backend/.venv" and keeps the poetry.lock
hash; update the key expression from poetry-venv-${{ runner.os }}-${{
hashFiles('backend/poetry.lock') }} to something like poetry-venv-${{ runner.os
}}-${{ steps.setup-python.outputs.python-version }}-${{
hashFiles('backend/poetry.lock') }} (or use your matrix variable) so venvs are
not reused across different Python versions.

In `@backend/entrypoint.fuzz.sh`:
- Around line 45-49: The shell invocation uses an unquoted variable ${TEST_FILE}
which can cause word splitting or globbing; update both pytest calls to use the
quoted variable "${TEST_FILE}" (i.e., change usages in the if/else blocks where
poetry run pytest ./tests/${TEST_FILE} and poetry run pytest
--log-cli-level=INFO -s ./tests/${TEST_FILE} appear) so pytest receives the
intended single path even if TEST_FILE contains spaces or glob characters.

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name=".github/workflows/setup-backend-environment/action.yaml">

<violation number="1" location=".github/workflows/setup-backend-environment/action.yaml:77">
P3: Remove the unused `BACKEND_PORT` environment variable from the migration step.</violation>
</file>

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name=".github/workflows/setup-backend-environment/action.yaml">

<violation number="1" location=".github/workflows/setup-backend-environment/action.yaml:45">
P1: The cache key uses `$${{ hashFiles(...) }}` instead of `${{ hashFiles(...) }}`, which prevents the lockfile hash from being evaluated and can cause stale dependency caches.</violation>
</file>

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/run-fuzz-tests.yaml:
- Around line 57-70: Replace the manual virtualenv activation and direct script
invocation with Poetry's runner: remove the "source ./.venv/bin/activate" step
and invoke the fuzz entrypoint via "poetry run" so the job uses Poetry's managed
venv; ensure environment variables (TEST_FILE, REST_URL, BASE_URL, CI,
PYTEST_ADDOPTS) remain exported before calling "poetry run sh
./entrypoint.fuzz.sh" (or "poetry run ./entrypoint.fuzz.sh" if executable) so
the same runtime behavior is preserved while avoiding a hardcoded ./.venv path.

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Duplicate comments:
In @.github/workflows/run-ci-cd.yaml:
- Around line 135-136: Swap the two parameters so db_username appears before
db_password in the workflow mapping; locate the entries named db_username and
db_password in the run-ci-cd.yaml job step and reorder them to place the
db_username: nest_user_e2e line immediately above db_password:
nest_user_e2e_password.