ci: optimize GitHub Actions workflows for efficiency

.github/dependabot.yml

@@ -15,7 +15,7 @@ updates:
     schedule:
       interval: "weekly"
       day: "monday"
-      time: "04:00"
+      time: "02:00"
       timezone: "UTC"
     open-pull-requests-limit: 5
     labels:
@@ -55,7 +55,7 @@ updates:
     schedule:
       interval: "weekly"
       day: "monday"
-      time: "04:00"
+      time: "03:00"
       timezone: "UTC"
     open-pull-requests-limit: 5
     labels:

.github/workflows/codeql.yml

@@ -3,8 +3,16 @@ name: "CodeQL"
 on:
   push:
     branches: [ main, develop ]
+    paths:
+      - "backend/**"
+      - "frontend/**"
+      - ".github/workflows/codeql.yml"
   pull_request:
     branches: [ main, develop ]
+    paths:
+      - "backend/**"
+      - "frontend/**"
+      - ".github/workflows/codeql.yml"
 
 jobs:
   analyze:
@@ -17,7 +25,7 @@ jobs:
       contents: read
 
     strategy:
-      fail-fast: true
+      fail-fast: false
       matrix:
         language: [python, javascript-typescript]
 
@@ -30,11 +38,31 @@ jobs:
         with:
           languages: ${{ matrix.language }}
 
-      - name: Autobuild
-        uses: github/codeql-action/autobuild@v4
+      - name: Set up Python (for Python analysis)
+        if: matrix.language == 'python'
+        uses: actions/setup-python@v6
+        with:
+          python-version: '3.13'
+          cache: 'pip'
+
+      - name: Install backend dependencies (for Python analysis)
+        if: matrix.language == 'python'
+        run: pip install -r backend/requirements.txt
+
+      - name: Set up Node.js (for JavaScript analysis)
+        if: matrix.language == 'javascript-typescript'
+        uses: actions/setup-node@v6
+        with:
+          node-version: '20'
+          cache: 'npm'
+          cache-dependency-path: 'frontend/package-lock.json'
+
+      - name: Install frontend dependencies (for JavaScript analysis)
+        if: matrix.language == 'javascript-typescript'
+        run: cd frontend && npm ci
 
       - name: Perform CodeQL Analysis
         uses: github/codeql-action/analyze@v4
         with:
           category: "/language:${{matrix.language}}"
-          upload: true
+          upload: ${{ github.ref == 'refs/heads/main' }}

.github/workflows/project-automation.yml

@@ -22,110 +22,48 @@ jobs:
 
     steps:
       - name: "Assign and Add to Project"
+        env:
+          GH_TOKEN: ${{ secrets.GH_PROJECT_TOKEN }}
         run: |
-          REPO="${{ github.repository }}"
-          TOKEN="${{ secrets.GH_PROJECT_TOKEN }}"
+          ASSIGNEE="${{ env.ASSIGNEE }}"
 
           # Se Issue
           if [ "${{ github.event_name }}" = "issues" ]; then
-            ITEM_ID="${{ github.event.issue.node_id }}"
             ISSUE_NUM="${{ github.event.issue.number }}"
-
             echo "Processing Issue #$ISSUE_NUM..."
 
             # Assegna Issue
-            echo "  - Assigning to ${{ env.ASSIGNEE }}..."
-            curl -s -X PATCH \
-              -H "Authorization: token $TOKEN" \
-              -H "Accept: application/vnd.github+json" \
-              -d "{\"assignees\":[\"${{ env.ASSIGNEE }}\"]}" \
-              "https://api.github.com/repos/$REPO/issues/$ISSUE_NUM" > /dev/null
-            echo "    Assigned"
+            echo "  - Assigning to $ASSIGNEE..."
+            gh issue edit "$ISSUE_NUM" --assignee "$ASSIGNEE" && echo "    Assigned" || echo "    Failed to assign"
 
             # Aggiungi al Project
             echo "  - Adding to Project..."
-
-            PAYLOAD=$(jq -n \
-              --arg query 'mutation($projectId:ID!, $itemId:ID!) { addProjectV2ItemById(input: {projectId: $projectId, contentId: $itemId}) { item { id } } }' \
-              --arg projectId "${{ env.PROJECT_ID }}" \
-              --arg itemId "$ITEM_ID" \
-              '{query: $query, variables: {projectId: $projectId, itemId: $itemId}}')
-
-            RESPONSE=$(curl -s -X POST \
-              -H "Authorization: token $TOKEN" \
-              -H "Content-Type: application/json" \
-              -d "$PAYLOAD" \
-              "https://api.github.com/graphql")
-
-            if echo "$RESPONSE" | jq -e '.data.addProjectV2ItemById.item.id' > /dev/null 2>&1; then
-              echo "    Added to Project"
-            else
-              echo "    Failed to add to Project"
-              echo "    Details: $(echo "$RESPONSE" | jq '.errors')"
-            fi
+            gh issue edit "$ISSUE_NUM" --add-project "${{ env.PROJECT_ID }}" && echo "    Added to Project" || echo "    Failed to add to Project"
           fi
 
           # Se Pull Request
           if [ "${{ github.event_name }}" = "pull_request" ]; then
-            ITEM_ID="${{ github.event.pull_request.node_id }}"
             PR_NUM="${{ github.event.pull_request.number }}"
             PR_ACTION="${{ github.event.action }}"
-
             echo "Processing PR #$PR_NUM ($PR_ACTION)..."
 
             # Assegna PR
-            echo "  - Assigning to ${{ env.ASSIGNEE }}..."
-            curl -s -X PATCH \
-              -H "Authorization: token $TOKEN" \
-              -H "Accept: application/vnd.github+json" \
-              -d "{\"assignees\":[\"${{ env.ASSIGNEE }}\"]}" \
-              "https://api.github.com/repos/$REPO/issues/$PR_NUM" > /dev/null
-            echo "    Assigned"
+            echo "  - Assigning to $ASSIGNEE..."
+            gh pr edit "$PR_NUM" --assignee "$ASSIGNEE" && echo "    Assigned" || echo "    Failed to assign"
 
-            # Aggiungi al Project (solo se opened o reopened)
+            # Aggiungi al Project e richiedi reviewer (solo se opened o reopened)
             if [ "$PR_ACTION" = "opened" ] || [ "$PR_ACTION" = "reopened" ]; then
               echo "  - Adding to Project..."
+              gh pr edit "$PR_NUM" --add-project "${{ env.PROJECT_ID }}" && echo "    Added to Project" || echo "    Failed to add to Project"
 
-              PAYLOAD=$(jq -n \
-                --arg query 'mutation($projectId:ID!, $itemId:ID!) { addProjectV2ItemById(input: {projectId: $projectId, contentId: $itemId}) { item { id } } }' \
-                --arg projectId "${{ env.PROJECT_ID }}" \
-                --arg itemId "$ITEM_ID" \
-                '{query: $query, variables: {projectId: $projectId, itemId: $itemId}}')
-
-              RESPONSE=$(curl -s -X POST \
-                -H "Authorization: token $TOKEN" \
-                -H "Content-Type: application/json" \
-                -d "$PAYLOAD" \
-                "https://api.github.com/graphql")
-
-              if echo "$RESPONSE" | jq -e '.data.addProjectV2ItemById.item.id' > /dev/null 2>&1; then
-                echo "    Added to Project"
-              else
-                echo "    Failed to add to Project"
-                echo "    Details: $(echo "$RESPONSE" | jq '.errors')"
-              fi
-
-              # Richiedi reviewer
               echo "  - Requesting reviewer..."
-              REVIEWER_RESPONSE=$(curl -s -X POST \
-                -H "Authorization: token $TOKEN" \
-                -H "Accept: application/vnd.github+json" \
-                -d "{\"reviewers\":[\"${{ env.ASSIGNEE }}\"]}" \
-                "https://api.github.com/repos/$REPO/pulls/$PR_NUM/requested_reviewers")
-
-              if echo "$REVIEWER_RESPONSE" | jq -e '.requested_reviewers[0].login' > /dev/null 2>&1; then
-                echo "    Reviewer requested successfully"
-              else
-                echo "    Failed to request reviewer"
-                echo "    Response: $(echo "$REVIEWER_RESPONSE" | jq '.' 2>/dev/null || echo "$REVIEWER_RESPONSE")"
-              fi
+              gh pr edit "$PR_NUM" --add-reviewer "$ASSIGNEE" && echo "    Reviewer requested successfully" || echo "    Failed to request reviewer"
             fi
 
             # Se PR è stato chiuso
             if [ "$PR_ACTION" = "closed" ]; then
               echo "  - PR closed"
-              PR_MERGED="${{ github.event.pull_request.merged }}"
-              if [ "$PR_MERGED" = "true" ]; then
+              if gh pr view "$PR_NUM" --json merged --jq '.merged' | grep -q true; then
                 echo "    PR merged - Item will auto-transition in Project"
               fi
             fi

.github/workflows/tests.yml

@@ -12,28 +12,31 @@ on:
       - "package-lock.json"
   pull_request:
     branches: [develop, main]
+    paths:
+      - "backend/**"
+      - "frontend/**"
+      - ".github/workflows/tests.yml"
+      - "pyproject.toml"
+      - "package.json"
+      - "package-lock.json"
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.head_ref || github.ref }}
   cancel-in-progress: true
 
 jobs:
   backend-tests:
-    name: Backend Tests (Python ${{ matrix.python-version }})
+    name: Backend Tests (Python 3.13)
     runs-on: ubuntu-latest
-    strategy:
-      fail-fast: false
-      matrix:
-        python-version: ['3.11', '3.12', '3.13']
 
     steps:
       - name: Checkout repository
         uses: actions/checkout@v7
 
-      - name: Set up Python ${{ matrix.python-version }}
+      - name: Set up Python 3.13
         uses: actions/setup-python@v6
         with:
-          python-version: ${{ matrix.python-version }}
+          python-version: '3.13'
           cache: 'pip'
 
       - name: Install dependencies
@@ -53,20 +56,20 @@ jobs:
         if: always()
         uses: actions/upload-artifact@v7
         with:
-          name: pytest-results-${{ matrix.python-version }}
+          name: pytest-results
           path: backend/pytest-results.xml
           retention-days: 7
 
       - name: Upload coverage report
-        if: always() && matrix.python-version == '3.13'
+        if: always()
         uses: actions/upload-artifact@v7
         with:
           name: coverage-report
           path: backend/coverage.xml
           retention-days: 30
 
       - name: Generate coverage summary
-        if: always() && matrix.python-version == '3.13'
+        if: always()
         run: |
           cd backend
           coverage report -m > coverage-summary.txt
@@ -88,14 +91,6 @@ jobs:
           cache: 'npm'
           cache-dependency-path: 'frontend/package-lock.json'
 
-      - name: Cache node_modules
-        uses: actions/cache@v6
-        with:
-          path: frontend/node_modules
-          key: ${{ runner.os }}-node-${{ hashFiles('frontend/package-lock.json') }}
-          restore-keys: |
-            ${{ runner.os }}-node-
-
       - name: Install dependencies
         run: |
           cd frontend
@@ -111,7 +106,17 @@ jobs:
           cd frontend
           npm run build
 
-      - name: Verify bundle size
+      - name: Verify bundle size (max 450KB combined)
         run: |
           cd frontend
-          du -sh dist/assets/*.js dist/assets/*.css 2>/dev/null || echo "Build artifacts verified"
+          JS_SIZE=$(du -b dist/assets/index.js | awk '{print $1}')
+          CSS_SIZE=$(du -b dist/assets/index.css | awk '{print $1}')
+          TOTAL=$((JS_SIZE + CSS_SIZE))
+          MAX_SIZE=$((450 * 1024))
+
+          echo "Bundle size: JS=${JS_SIZE} bytes, CSS=${CSS_SIZE} bytes, Total=${TOTAL} bytes (max=${MAX_SIZE})"
+          if [ $TOTAL -gt $MAX_SIZE ]; then
+            echo "ERROR: Bundle exceeds ${MAX_SIZE} bytes limit"
+            exit 1
+          fi
+          echo "✓ Bundle size check passed"