fix: migrate startup event to lifespan context manager - Fixes #306

[Tirthpanchori]

Before opening: make sure there is an issue tracking this work, and link it below. PRs without a linked issue may be closed without review.

Linked issue

Closes #306

What this PR does

Migrates the FastAPI app's startup logic from the deprecated @app.on_event("startup") decorator to the lifespan async context manager pattern, removing the DeprecationWarning emitted at server start.

Type of change

• Bug fix
• New feature
• ML model / training pipeline
• Refactor (no behaviour change)
• Documentation
• Tests only

ML tier (if applicable)

• Tier 1 — Triage
• Tier 2 — Predictive
• Tier 3 — Autonomous
• Not ML-related

Stack affected

• Backend
• Frontend
• Both

---

Changes

Backend

• Replaced @app.on_event("startup") with an asynccontextmanager-based lifespan function.
• init_db() and the background _cleanup_active_scans_loop() task now run inside lifespan, unchanged in behaviour.
• FastAPI(...) constructor now takes lifespan=lifespan.

Frontend

• No frontend changes.

New dependencies

• None.

Database / schema changes

• None.

---

Testing

How did you test this?

• Ran python -m pytest tests/ -v before the change: 109 passed, on_event deprecation warning present in the summary.
• Made the change, reran the same suite: 109 passed, on_event warning gone.
• Started the server locally with uvicorn app.main:app --reload --port 8000 and confirmed no deprecation warning in console output, and /health responded correctly.

Checklist

• Tested locally end-to-end (upload ZIP or GitHub URL → scan → findings returned correctly)
• New ML model falls back gracefully when model file is absent
• No new console.error or unhandled Python exceptions introduced
• Added or updated tests where applicable — no new tests needed, existing suite covers this; unchanged pass count confirms no regression
• requirements.txt / package.json updated if new dependencies added
• New model files (.pkl, .pt, etc.) are gitignored, not committed

---

Anything reviewers should focus on

Confirm the lifespan function is defined before app = FastAPI(...) (required since it's referenced in the constructor), and that init_db() + the cleanup task still fire correctly on a real server start, not just under test.

Screenshots (if UI changed)

N/A (backend-only, no UI change)

[github-actions]

🎉 Thank you @Tirthpanchori for submitting a Pull Request!

We're excited to review your contribution.

✅ Before Review

• Ensure all CI checks pass.
• Complete the PR template.
• Link the related issue.

⚡ Want faster reviews and contributor support?

Join our Discord community:

🔗 https://discord.gg/FcXuyw2Rs

Maintainers and mentors are active there and can help resolve blockers quickly.

Happy Contributing! 🚀

[Tirthpanchori]

hey @arpit2006 @ionfwsrijan if everything is ok can you merge this pr before 12, it'll get counted in my score for SSoC. Thank you

[arpit2006]

@Tirthpanchori , Fix CI fails

[Tirthpanchori]

@arpit2006 the PR Guardrails / triage-and-label check is failing on this PR, but it's unrelated to this change. It's GitHub's built-in fork-security block on pull_request_target workflows — it refuses to check out fork PR code into a workflow that runs with the base repo's GITHUB_TOKEN and secrets, to prevent "pwn request" attacks. This will fail on any PR from a fork, regardless of what the PR actually changes. All other checks (lint, format, tests across Python 3.10–3.12) pass.

[arpit2006]

LGTM! 🚀

Review Summary

• Lifespan Migration: Clean replacement of the deprecated @app.on_event("startup") handler with asynccontextmanager lifespan(app: FastAPI).
• Order & Scope: lifespan is defined prior to FastAPI(...) initialization and passed via lifespan=lifespan. Diff is clean and tightly scoped to backend/app/main.py.
• Functionality Preserved: init_db() and _cleanup_active_scans_loop() are properly executed on startup.

@ionfwsrijan , Ready to Merge!