[zackary-masri]

Closes #5

Why nothing ever ran

The workflow files were fine. GitHub Actions just wasn't turned on for this repo. Someone has since turned it on (Actions made an automatic commit on #10 on Oct 24).

What this PR changes

• backend.yml: backend checks (lint + tests) now run on every PR, not only PRs that touch training/.
• aws.yml: used to deploy to the old team's AWS on any push to prod-deploy (that branch still exists). Now manual-only.
• terraform-validate.yml: used to run on any change to dlp-terraform/. Now manual-only.

push-django-ecs.yml and push-training-ecs.yml were already manual-only, so I left them. Nobody should click "Run workflow" on any of these four until AWS ownership is confirmed.

Frontend checks

These install the newest pnpm, which doesn't match our old lockfile. Dan's #10 fixes this, so frontend should go green once #10 is merged.

Backend test fix

The backend test job crashed before any test ran (ImportError: cannot import name 'TypeIs'). Setup installs the latest PyTorch, then poetry install replaced typing-extensions with the old 4.8.0 from training/poetry.lock, which is too old for PyTorch. Bumped that one entry to 4.12.2.

Frontend fails with ERR_PNPM_BROKEN_LOCKFILE (lockfile v6 vs pnpm that needs v9), which is what #10 fixes.

---

Note

Low Risk
Changes are limited to GitHub Actions triggers and a dependency lock bump; no runtime application or auth logic is modified.

Overview
Backend CI now runs lint and tests on every pull request by removing the training/** path filter from backend.yml, so changes outside training/ still get checked.

AWS-related automation is paused until account ownership is confirmed (#5): aws.yml no longer deploys on pushes to prod-deploy and only runs via workflow_dispatch, with the same manual-only trigger applied to terraform-validate.yml (replacing push/PR runs on dlp-terraform/**). Comments in those workflows document the Fall 2026 pause.

Backend tests in CI should stop failing on ImportError: cannot import name 'TypeIs' after typing-extensions is bumped from 4.8.0 to 4.12.2 in training/poetry.lock, so Poetry no longer downgrades typing support below what current PyTorch expects.

^{Reviewed by Cursor Bugbot for commit a3a4270. Bugbot is set up for automated code reviews on this repo. Configure here.}

[alessiopagliarulo]

Thanks Zackary! Verified: frontend and backend checks all pass on the latest commit, and this also fixes the TypeIs import error that broke backend tests on nextjs. Merging.