ci: fix failing checks on f/rebuild PR

The monorepo modernization introduced several CI regressions because the
backend repo is checked out standalone (the `frontend` submodule is absent)
and because tooling/action versions had bit-rotted.

- pytest / license-check: `docker compose up -d` built every service,
  including the new `frontend` (`context: ../frontend`, missing in a
  backend-only checkout). Start only `django`; postgres/redis come up as
  deps. Same fix for the trivy build in security.yml (`build django`).
- dockle / trivy: pin `image: backend-django` on the django service so the
  built image name no longer depends on the checkout-directory/project name.
- dockerlint: a comment sat inside the multi-line `ENV` continuation
  ("Empty / bogus instruction on line 13"); moved it above the `ENV`.
- hadolint DL3022: `COPY --from=ghcr.io/astral-sh/uv` referenced an external
  image; introduce a named `FROM ghcr.io/astral-sh/uv:0.9 AS uv` stage.
- textlint: `setup-node@v1` + node 15 lacked `node:stream/consumers`
  (needs Node >=16.7); bump to setup-node@v4 / node 20.
- actionlint: bump deprecated runners (checkout@v2/v3 -> v4,
  setup-node@v1 -> v4, setup-python@v3 -> v5, upload-artifact@v2 -> v4) and
  fix shellcheck quoting (SC2016/SC2086) in autoblack.yml.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: Uno-Takashi

.github/workflows/autoblack.yml

@@ -28,7 +28,7 @@ jobs:
           uvx ruff format .
           uvx ruff check --fix .
           git config --global user.name github-actions || exit 0;
-          git config --global user.email '${GITHUB_ACTOR}@users.noreply.github.com' || exit 0;
-          git remote set-url origin https://x-access-token:${{ secrets.GITHUB_TOKEN }}@github.com/$GITHUB_REPOSITORY || exit 0;
+          git config --global user.email "${GITHUB_ACTOR}@users.noreply.github.com" || exit 0;
+          git remote set-url origin "https://x-access-token:${{ secrets.GITHUB_TOKEN }}@github.com/$GITHUB_REPOSITORY" || exit 0;
           git commit -am "style: apply ruff format/fixes" || exit 0;
-          git push --force origin HEAD:$GITHUB_REF || exit 0;
+          git push --force origin "HEAD:$GITHUB_REF" || exit 0;

.github/workflows/code-quality-review.yml

@@ -22,21 +22,21 @@ jobs:
   actionlint:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
       - uses: reviewdog/action-actionlint@v1
         with:
           reporter: "github-pr-review"
   textlint:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v2
+        uses: actions/checkout@v4
         with:
           submodules: true
       - name: Setup node/npm
-        uses: actions/setup-node@v1
+        uses: actions/setup-node@v4
         with:
-          node-version: "15"
+          node-version: "20"
       - run: |
           npm install --save-dev textlint textlint-rule-write-good
       - name: textlint-github-pr-review

.github/workflows/code-quality.yml

@@ -8,7 +8,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 15
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
       - name: Lizard Runner
         uses: Uno-Takashi/Lizard-Runner@v3
         with:
@@ -19,13 +19,13 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
         with:
           submodules: true
       - name: Setup node/npm
-        uses: actions/setup-node@v1
+        uses: actions/setup-node@v4
         with:
-          node-version: "15"
+          node-version: "20"
       - name: install dockerlint
         run: |
           npm install -g dockerlint
@@ -34,15 +34,15 @@ jobs:
   hadolint:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
       - uses: hadolint/hadolint-action@v2.0.0
         with:
           dockerfile: ./Django/Dockerfile
           ignore: "DL3008,SC2174,DL3009,DL3059,SC3009"
   dockle:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
       - run: |
           docker compose build django
       - name: Run Dockle
@@ -54,25 +54,25 @@ jobs:
   actionlint:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
       - uses: reviewdog/action-actionlint@v1
   shellcheck:
     name: Shellcheck
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
       - name: Run ShellCheck
         uses: ludeeus/action-shellcheck@master
   yamllint:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
       - name: yaml-lint
         uses: ibiqlik/action-yamllint@v3
   # nginx-conf-check:
   #   runs-on: ubuntu-latest
   #   steps:
-  #     - uses: actions/checkout@v3
+  #     - uses: actions/checkout@v4
   #     - name: run docker-compose
   #       run: |
   #         docker-compose up -d

.github/workflows/license-check.yml

@@ -10,8 +10,12 @@ jobs:
     steps:
       - uses: actions/checkout@v4
       - name: run docker compose
+        # Only the django service (and its postgres/redis deps) is needed here.
+        # Starting the whole stack would try to build the `frontend` service,
+        # whose `context: ../frontend` does not exist in this backend-only
+        # checkout (it is a sibling submodule of the monorepo).
         run: |
-          docker compose up -d
+          docker compose up -d django
       - name: init containers
         run: |
           docker compose exec -T django python manage.py makemigrations;

.github/workflows/pytest.yml

@@ -10,8 +10,12 @@ jobs:
     steps:
       - uses: actions/checkout@v4
       - name: run docker compose
+        # Only the django service (and its postgres/redis deps) is needed for
+        # tests. Starting the whole stack would try to build the `frontend`
+        # service, whose `context: ../frontend` does not exist in this
+        # backend-only checkout (it is a sibling submodule of the monorepo).
         run: |
-          docker compose up -d
+          docker compose up -d django
       - name: init containers
         run: |
           docker compose exec -T django python manage.py makemigrations;

.github/workflows/release.yml

@@ -14,7 +14,7 @@ jobs:
   release:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v4
       - name: Create Release
         id: create_release
         uses: actions/create-release@v1

.github/workflows/security.yml

@@ -10,19 +10,19 @@ jobs:
   bandit:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/setup-python@v3
+      - uses: actions/setup-python@v5
         with:
           python-version: "3.9"
       - name: install bandit
         run: pip install bandit
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
       - name: run bandit
         run: |
           bandit Django -r -o ./bandit.txt -f txt -c ./.github/bandit.yml
       - name: Archive bandit log
         if: always()
-        uses: actions/upload-artifact@v2
+        uses: actions/upload-artifact@v4
         with:
           name: bandit-report
           path: ./bandit.txt
@@ -33,19 +33,19 @@ jobs:
         run: |
           sudo apt-get update
           sudo apt-get install moreutils -y
-      - uses: actions/setup-python@v3
+      - uses: actions/setup-python@v5
         with:
           python-version: "3.9"
       - name: install python-taint
         run: pip install python-taint
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
       - name: run pyt
         run: |
           pyt -a D -o pyt.txt ./Django
       - name: Archive pyt log
         if: always()
-        uses: actions/upload-artifact@v2
+        uses: actions/upload-artifact@v4
         with:
           name: pyt-report
           path: ./pyt.txt
@@ -63,7 +63,7 @@ jobs:
         language: ["python"]
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
       - name: Initialize CodeQL
         uses: github/codeql-action/init@v3
         with:
@@ -78,8 +78,11 @@ jobs:
     steps:
       - uses: actions/checkout@v4
       - name: run docker compose
+        # Build only the django image; building the full stack would try to
+        # build the `frontend` service (`context: ../frontend`), absent in this
+        # backend-only checkout.
         run: |
-          docker compose build
+          docker compose build django
       - name: Run Trivy vulnerability scanner
         uses: aquasecurity/trivy-action@master
         with:

Django/Dockerfile

@@ -1,16 +1,21 @@
 # syntax=docker/dockerfile:1
+
+# Bring in the uv binary from the official image as a named stage so the COPY
+# below references a previously defined FROM alias (hadolint DL3022).
+FROM ghcr.io/astral-sh/uv:0.9 AS uv
+
 FROM python:3.13-slim-bookworm
 
-# Bring in the uv binary from the official image.
-COPY --from=ghcr.io/astral-sh/uv:0.9 /uv /uvx /bin/
+COPY --from=uv /uv /uvx /bin/
 
+# Keep UV_PROJECT_ENVIRONMENT (the virtualenv) outside the app dir so a
+# bind-mount over the source (docker-compose) does not shadow the installed
+# dependencies.
 ENV PYTHONDONTWRITEBYTECODE=1 \
     PYTHONUNBUFFERED=1 \
     DEBCONF_NOWARNINGS=yes \
     UV_COMPILE_BYTECODE=1 \
     UV_LINK_MODE=copy \
-    # Keep the virtualenv outside the app dir so a bind-mount over the source
-    # (docker-compose) does not shadow the installed dependencies.
     UV_PROJECT_ENVIRONMENT=/opt/venv \
     PATH="/opt/venv/bin:$PATH"
 

docker-compose.yml

@@ -23,6 +23,9 @@ services:
     env_file: *env_file
   django:
     container_name: django
+    # Pin the built image name so it does not depend on the compose project
+    # (checkout-directory) name; dockle/trivy in CI scan `backend-django`.
+    image: backend-django
     build:
       context: Django
       dockerfile: Dockerfile