fix: add missing status transition from approval to execution

.github/workflows/beta-release.yml

@@ -91,6 +91,8 @@ jobs:
 
       - name: Install Rust toolchain (for building native Python packages)
         uses: dtolnay/rust-toolchain@stable
+        with:
+          toolchain: '1.83.0'
 
       - name: Cache bundled Python
         uses: actions/cache@v4
@@ -142,6 +144,7 @@ jobs:
             apps/frontend/dist/*.dmg
             apps/frontend/dist/*.zip
             apps/frontend/dist/*.yml
+          if-no-files-found: error
 
   # Apple Silicon build on ARM64 runner for native compilation
   build-macos-arm64:
@@ -221,6 +224,7 @@ jobs:
             apps/frontend/dist/*.dmg
             apps/frontend/dist/*.zip
             apps/frontend/dist/*.yml
+          if-no-files-found: error
 
   build-windows:
     needs: create-tag
@@ -278,6 +282,7 @@ jobs:
           path: |
             apps/frontend/dist/*.exe
             apps/frontend/dist/*.yml
+          if-no-files-found: error
 
   build-linux:
     needs: create-tag
@@ -342,6 +347,7 @@ jobs:
             apps/frontend/dist/*.deb
             apps/frontend/dist/*.flatpak
             apps/frontend/dist/*.yml
+          if-no-files-found: error
 
   create-release:
     needs: [create-tag, build-macos-intel, build-macos-arm64, build-windows, build-linux]

.github/workflows/ci.yml

@@ -35,6 +35,16 @@ jobs:
         uses: astral-sh/setup-uv@v4
         with:
           version: "latest"
+          enable-cache: true
+
+      - name: Cache Python dependencies
+        uses: actions/cache@v4
+        with:
+          path: ~/.cache/uv
+          key: ${{ runner.os }}-uv-${{ matrix.python-version }}-${{ hashFiles('apps/backend/requirements.txt', 'tests/requirements-test.txt') }}
+          restore-keys: |
+            ${{ runner.os }}-uv-${{ matrix.python-version }}-
+            ${{ runner.os }}-uv-
 
       - name: Install dependencies
         working-directory: apps/backend

.github/workflows/quality-security.yml

@@ -67,7 +67,8 @@ jobs:
           echo "::group::Running Bandit security scan"
           # Run Bandit; exit code 1 means issues found (expected), other codes are errors
           # Flags: -r=recursive, -ll=severity LOW+, -ii=confidence LOW+, -f=format, -o=output
-          bandit -r apps/backend/ -ll -ii -f json -o bandit-report.json || BANDIT_EXIT=$?
+          # Scan both backend code and tests for security vulnerabilities
+          bandit -r apps/backend/ tests/ -ll -ii -f json -o bandit-report.json || BANDIT_EXIT=$?
           if [ "${BANDIT_EXIT:-0}" -gt 1 ]; then
             echo "::error::Bandit scan failed with exit code $BANDIT_EXIT"
             exit 1

.github/workflows/release.yml

@@ -12,6 +12,9 @@ on:
         default: true
         type: boolean
 
+permissions:
+  contents: read
+
 jobs:
   # Intel build on Intel runner for native compilation
   # Note: macos-15-intel is the last Intel runner, supported until Fall 2027
@@ -23,7 +26,7 @@ jobs:
       - name: Setup Python
         uses: actions/setup-python@v5
         with:
-          python-version: '3.11'
+          python-version: '3.12.8'
 
       - name: Setup Node.js
         uses: actions/setup-node@v4
@@ -45,6 +48,8 @@ jobs:
 
       - name: Install Rust toolchain (for building native Python packages)
         uses: dtolnay/rust-toolchain@stable
+        with:
+          toolchain: '1.83.0'
 
       - name: Cache bundled Python
         uses: actions/cache@v4
@@ -93,6 +98,7 @@ jobs:
           path: |
             apps/frontend/dist/*.dmg
             apps/frontend/dist/*.zip
+          if-no-files-found: error
 
   # Apple Silicon build on ARM64 runner for native compilation
   build-macos-arm64:
@@ -103,7 +109,7 @@ jobs:
       - name: Setup Python
         uses: actions/setup-python@v5
         with:
-          python-version: '3.11'
+          python-version: '3.12.8'
 
       - name: Setup Node.js
         uses: actions/setup-node@v4
@@ -170,6 +176,7 @@ jobs:
           path: |
             apps/frontend/dist/*.dmg
             apps/frontend/dist/*.zip
+          if-no-files-found: error
 
   build-windows:
     runs-on: windows-latest
@@ -179,7 +186,7 @@ jobs:
       - name: Setup Python
         uses: actions/setup-python@v5
         with:
-          python-version: '3.11'
+          python-version: '3.12.8'
 
       - name: Setup Node.js
         uses: actions/setup-node@v4
@@ -224,6 +231,7 @@ jobs:
           name: windows-builds
           path: |
             apps/frontend/dist/*.exe
+          if-no-files-found: error
 
   build-linux:
     runs-on: ubuntu-latest
@@ -233,7 +241,7 @@ jobs:
       - name: Setup Python
         uses: actions/setup-python@v5
         with:
-          python-version: '3.11'
+          python-version: '3.12.8'
 
       - name: Setup Node.js
         uses: actions/setup-node@v4
@@ -255,6 +263,7 @@ jobs:
 
       - name: Setup Flatpak
         run: |
+          set -e
           sudo apt-get update
           sudo apt-get install -y flatpak flatpak-builder
           flatpak remote-add --user --if-not-exists flathub https://flathub.org/repo/flathub.flatpakrepo
@@ -285,6 +294,7 @@ jobs:
             apps/frontend/dist/*.AppImage
             apps/frontend/dist/*.deb
             apps/frontend/dist/*.flatpak
+          if-no-files-found: error
 
   create-release:
     needs: [build-macos-intel, build-macos-arm64, build-windows, build-linux]

.github/workflows/welcome.yml

@@ -13,7 +13,7 @@ jobs:
       issues: write
       pull-requests: write
     steps:
-      - uses: actions/first-interaction@v1
+      - uses: actions/first-interaction@v1.3.0
         with:
           repo-token: ${{ secrets.GITHUB_TOKEN }}
           issue-message: |