From f2bcce702a68472378b9ff39787bb6499386eb4c Mon Sep 17 00:00:00 2001 From: Carlos Escalante Date: Fri, 3 Jul 2026 19:52:39 -0600 Subject: [PATCH] CI: pin dependency resolution with constraints.txt Fresh-venv installs started failing with pip ResolutionTooDeep because requirements.txt is unpinned. Constrain CI and image builds to the frozen, test-passing local set; requirements.txt stays the source of intent. Co-Authored-By: Claude Opus 4.8 (1M context) --- .github/workflows/deploy.yml | 2 +- backend/Dockerfile | 4 +- backend/Dockerfile.prod | 4 +- backend/constraints.txt | 182 +++++++++++++++++++++++++++++++++++ 4 files changed, 187 insertions(+), 5 deletions(-) create mode 100644 backend/constraints.txt diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml index 6874a25..3c3b8e7 100644 --- a/.github/workflows/deploy.yml +++ b/.github/workflows/deploy.yml @@ -15,7 +15,7 @@ jobs: run: | cd backend python3 -m venv /tmp/test-venv - /tmp/test-venv/bin/pip install --quiet -r requirements.txt -r requirements-dev.txt + /tmp/test-venv/bin/pip install --quiet -r requirements.txt -r requirements-dev.txt -c constraints.txt /tmp/test-venv/bin/python -m pytest tests/ -q - name: Frontend typecheck + API type drift gate diff --git a/backend/Dockerfile b/backend/Dockerfile index 81a76e4..4359b04 100644 --- a/backend/Dockerfile +++ b/backend/Dockerfile @@ -1,7 +1,7 @@ FROM python:3.11-slim WORKDIR /app RUN apt-get update && apt-get install -y --no-install-recommends poppler-utils && rm -rf /var/lib/apt/lists/* -COPY requirements.txt . -RUN pip install --no-cache-dir --pre -r requirements.txt +COPY requirements.txt constraints.txt ./ +RUN pip install --no-cache-dir --pre -r requirements.txt -c constraints.txt COPY . . CMD ["uvicorn", "app.main:app", "--host", "0.0.0.0", "--port", "8000", "--reload"] diff --git a/backend/Dockerfile.prod b/backend/Dockerfile.prod index 1fa51b8..e6dd8ae 100644 --- a/backend/Dockerfile.prod +++ b/backend/Dockerfile.prod @@ -1,7 +1,7 @@ FROM python:3.11-slim WORKDIR /app RUN apt-get update && apt-get install -y --no-install-recommends poppler-utils && rm -rf /var/lib/apt/lists/* -COPY requirements.txt . -RUN pip install --no-cache-dir -r requirements.txt +COPY requirements.txt constraints.txt ./ +RUN pip install --no-cache-dir -r requirements.txt -c constraints.txt COPY . . CMD ["uvicorn", "app.main:app", "--host", "0.0.0.0", "--port", "8000", "--workers", "2"] diff --git a/backend/constraints.txt b/backend/constraints.txt new file mode 100644 index 0000000..8b3f226 --- /dev/null +++ b/backend/constraints.txt @@ -0,0 +1,182 @@ +a2a-sdk==0.3.23 +ag-ui-protocol==0.1.19 +agent-framework==1.2.1 +agent-framework-a2a==1.0.0b260428 +agent-framework-ag-ui==1.0.0b260428 +agent-framework-anthropic==1.0.0b260428 +agent-framework-azure-ai-search==1.0.0b260428 +agent-framework-azure-cosmos==1.0.0b260428 +agent-framework-azurefunctions==1.0.0b260428 +agent-framework-bedrock==1.0.0b260428 +agent-framework-chatkit==1.0.0b260428 +agent-framework-claude==1.0.0b260428 +agent-framework-copilotstudio==1.0.0b260428 +agent-framework-core==1.2.1 +agent-framework-declarative==1.0.0b260428 +agent-framework-devui==1.0.0b260428 +agent-framework-durabletask==1.0.0b260428 +agent-framework-foundry==1.2.1 +agent-framework-foundry-local==1.0.0b260428 +agent-framework-github-copilot==1.0.0b260402 +agent-framework-lab==1.0.0b251024 +agent-framework-mem0==1.0.0b260428 +agent-framework-ollama==1.0.0b260428 +agent-framework-openai==1.2.1 +agent-framework-orchestrations==1.0.0b260428 +agent-framework-purview==1.0.0b260428 +agent-framework-redis==1.0.0b260428 +aiohappyeyeballs==2.6.2 +aiohttp==3.14.1 +aiosignal==1.4.0 +alembic==1.18.4 +annotated-doc==0.0.4 +annotated-types==0.7.0 +anthropic==0.80.0 +anyio==4.13.0 +async-timeout==5.0.1 +asyncio==4.0.0 +attrs==26.1.0 +azure-ai-inference==1.0.0b9 +azure-ai-projects==2.2.0 +azure-common==1.1.28 +azure-core==1.41.0 +azure-cosmos==4.16.1 +azure-functions==1.24.0 +azure-functions-durable==1.5.0 +azure-identity==1.25.3 +azure-search-documents==11.7.0b2 +azure-storage-blob==12.30.0 +backoff==2.2.1 +bcrypt==5.0.0 +boto3==1.43.26 +botocore==1.43.26 +certifi==2026.5.20 +cffi==2.0.0 +charset-normalizer==3.4.7 +claude-agent-sdk==0.1.48 +click==8.4.1 +clr_loader==0.2.10 +cryptography==48.0.1 +detect-installer==0.1.0 +distro==1.9.0 +dnspython==2.8.0 +docstring_parser==0.18.0 +durabletask==1.5.0 +durabletask.azuremanaged==1.5.0 +ecdsa==0.19.2 +email-validator==2.3.0 +fastapi==0.133.0 +fastapi-cli==0.0.24 +fastapi-cloud-cli==0.19.0 +fastar==0.11.0 +foundry-local-sdk==0.5.1 +frozenlist==1.8.0 +furl==2.1.4 +github-copilot-sdk==0.1.32 +google-api-core==2.31.0 +google-auth==2.53.0 +googleapis-common-protos==1.75.0 +griffelib==2.0.2 +grpcio==1.81.0 +h11==0.16.0 +h2==4.3.0 +hpack==4.1.0 +http-ece==1.2.1 +httpcore==1.0.9 +httptools==0.8.0 +httpx==0.28.1 +httpx-sse==0.4.3 +hyperframe==6.1.0 +idna==3.18 +iniconfig==2.3.0 +isodate==0.7.2 +Jinja2==3.1.6 +jiter==0.15.0 +jmespath==1.1.0 +jsonpath-ng==1.8.0 +jsonschema==4.26.0 +jsonschema-specifications==2025.9.1 +Mako==1.3.12 +markdown-it-py==4.2.0 +MarkupSafe==3.0.3 +mcp==1.27.2 +mdurl==0.1.2 +mem0ai==1.0.11 +microsoft-agents-activity==0.3.1 +microsoft-agents-copilotstudio-client==0.3.1 +microsoft-agents-hosting-core==0.3.1 +ml_dtypes==0.5.4 +msal==1.37.0 +msal-extensions==1.3.1 +multidict==6.7.1 +numpy==2.4.6 +ollama==0.5.3 +openai==2.41.0 +openai-agents==0.17.4 +openai-chatkit==1.6.5 +opentelemetry-api==1.42.1 +opentelemetry-sdk==1.42.1 +opentelemetry-semantic-conventions==0.63b1 +orderedmultidict==1.0.2 +packaging==26.2 +passlib==1.7.4 +pluggy==1.6.0 +portalocker==3.2.0 +posthog==7.18.0 +powerfx==0.0.34 +propcache==0.5.2 +proto-plus==1.28.0 +protobuf==6.33.6 +psycopg2-binary==2.9.12 +py-vapid==1.9.4 +pyasn1==0.6.3 +pyasn1_modules==0.4.2 +pycparser==3.0 +pydantic==2.13.4 +pydantic-extra-types==2.11.1 +pydantic-settings==2.14.1 +pydantic_core==2.46.4 +Pygments==2.20.0 +PyJWT==2.13.0 +pytest==9.0.3 +python-dateutil==2.9.0.post0 +python-dotenv==1.2.2 +python-jose==3.5.0 +python-multipart==0.0.32 +python-ulid==3.1.0 +pythonnet==3.0.5 +pytz==2026.2 +pywebpush==2.3.0 +PyYAML==6.0.3 +qdrant-client==1.18.0 +redis==7.1.1 +redisvl==0.15.0 +referencing==0.37.0 +requests==2.34.2 +rich==15.0.0 +rich-toolkit==0.20.1 +rignore==0.7.6 +rpds-py==2026.5.1 +rsa==4.9.1 +s3transfer==0.18.0 +sentry-sdk==2.62.0 +shellingham==1.5.4 +six==1.17.0 +sniffio==1.3.1 +SQLAlchemy==2.0.50 +sqlmodel==0.0.38 +sse-starlette==3.4.4 +starlette==1.2.1 +tenacity==9.1.4 +tqdm==4.68.2 +typer==0.26.7 +types-requests==2.33.0.20260518 +typing-inspection==0.4.2 +typing_extensions==4.15.0 +urllib3==2.7.0 +uvicorn==0.41.0 +uvloop==0.22.1 +watchfiles==1.2.0 +websockets==16.0 +Werkzeug==3.1.8 +yarl==1.24.2