CI: make the required checks reportable, narrow Docker, cover backend deps

.github/dependabot.yml

@@ -10,5 +10,10 @@ updates:
     schedule:
       interval: weekly
 
-  # Backend Python dependencies are updated via the python-copier-template
-  # sync (uv.lock is regenerated on each render), so uv is not listed here.
+  # The backend package lives in a subdirectory, so it needs its own entry
+  # (`uv.lock` there is already picked up by the dependency graph, but an entry
+  # is what turns alerts into pull requests).
+  - package-ecosystem: uv
+    directory: /backend
+    schedule:
+      interval: weekly

.github/workflows/backend.yml

@@ -5,9 +5,7 @@ name: Backend
 on:
   push:
     branches: [main]
-    paths: ["backend/**", ".github/workflows/backend.yml"]
   pull_request:
-    paths: ["backend/**", ".github/workflows/backend.yml"]
 
 jobs:
   backend:

.github/workflows/contract.yml

@@ -7,9 +7,7 @@ name: Contract
 on:
   push:
     branches: [main]
-    paths: ["frontend/**", "backend/**", ".github/workflows/contract.yml"]
   pull_request:
-    paths: ["frontend/**", "backend/**", ".github/workflows/contract.yml"]
 
 jobs:
   contract:

.github/workflows/docker.yml

@@ -1,28 +1,14 @@
-# Builds both container images and runs the composed stack, checking the same
-# contract as contract.yml but through nginx — catches images that build but
-# cannot start (missing runtime deps, broken CMD, bad base tags) and proxy
-# misconfiguration. Complements the docker.yml that python-copier-template
-# renders into standalone backend repos.
+# Builds both container images and runs the composed stack: catches images that
+# build but cannot start (missing runtime deps, broken CMD, bad base tags), a
+# broken nginx config, and compose wiring. The API contract itself is checked by
+# contract.yml. Complements the docker.yml that python-copier-template renders
+# into standalone backend repos.
 name: Docker
 
 on:
   push:
     branches: [main]
-    paths:
-      [
-        "frontend/**",
-        "backend/**",
-        "compose.yaml",
-        ".github/workflows/docker.yml",
-      ]
   pull_request:
-    paths:
-      [
-        "frontend/**",
-        "backend/**",
-        "compose.yaml",
-        ".github/workflows/docker.yml",
-      ]
 
 jobs:
   docker:
@@ -39,18 +25,14 @@ jobs:
       - name: "Frontend served"
         run: curl -sf http://localhost:8080/ | grep -q "<title>React Template</title>"
 
-      - name: "Contract via nginx: GET /api/ returns version info"
+      # One request is enough to prove the wiring: reaching /health under /api
+      # means the image runs and nginx strips the prefix. The endpoints
+      # themselves are the Contract workflow's job.
+      - name: "Backend reachable through the /api proxy"
         run: |
-          body=$(curl -sf http://localhost:8080/api/)
+          body=$(curl -sf http://localhost:8080/api/health)
           echo "$body"
-          echo "$body" | jq -e 'to_entries[0].value | test("version")'
-
-      - name: "Contract via nginx: POST /api/predict echoes the input"
-        run: |
-          body=$(curl -sf -X POST http://localhost:8080/api/predict \
-            -H "Content-Type: application/json" -d '{"input": 5}')
-          echo "$body"
-          echo "$body" | jq -e '.output == 5'
+          echo "$body" | jq -e '.status == "ok"'
 
       - name: Container logs
         if: always()

.github/workflows/frontend.yml

@@ -3,9 +3,7 @@ name: Frontend
 on:
   push:
     branches: [main]
-    paths: ["frontend/**", ".github/workflows/frontend.yml"]
   pull_request:
-    paths: ["frontend/**", ".github/workflows/frontend.yml"]
 
 jobs:
   frontend: