From 924a11da0841877c3d3fc7e4133540fad34607c1 Mon Sep 17 00:00:00 2001
From: Nithu John <85367999+nithujohn@users.noreply.github.com>
Date: Wed, 19 Aug 2026 11:42:08 +0100
Subject: [PATCH 1/3] Pin sdrf-pipelines 0.1.6 so /health reports a stable
 release.

The unpinned git URL left production on 0.1.5, which still requires
characteristics[environmental sample type]. 0.1.6 vendors the updated
metaproteomics template (environmental medium required instead).

Co-authored-by: Cursor <cursoragent@cursor.com>
---
 .github/workflows/docker-build.yaml | 2 +-
 Dockerfile                          | 6 +++---
 requirements.txt                    | 8 ++++++--
 3 files changed, 10 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/docker-build.yaml b/.github/workflows/docker-build.yaml
index 7a36f3b..9422afa 100644
--- a/.github/workflows/docker-build.yaml
+++ b/.github/workflows/docker-build.yaml
@@ -58,7 +58,7 @@ jobs:
           cache-from: type=gha
           cache-to: type=gha,mode=max
           # Pass the commit SHA as CACHEBUST so the pip-install layer always
-          # re-runs and unpinned VCS deps (sdrf-pipelines main HEAD) are refreshed.
+          # re-runs against the pinned requirements.txt.
           build-args: |
             CACHEBUST=${{ github.sha }}
 
diff --git a/Dockerfile b/Dockerfile
index 75f158d..9ac47aa 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -22,11 +22,11 @@ RUN groupadd -r appuser && useradd -r -g appuser appuser
 # Copy requirements first for better caching
 COPY requirements.txt .
 
-# Cache-bust the pip install layer so unpinned VCS deps (sdrf-pipelines main HEAD)
-# are re-fetched on every build. The CI pipeline passes the commit SHA here.
+# Cache-bust the pip install layer on every CI build so dependency pins in
+# requirements.txt are installed fresh. The CI pipeline passes the commit SHA here.
 ARG CACHEBUST=dev
 
-# Install Python dependencies. --upgrade ensures any unpinned VCS dep tracks main HEAD.
+# Install Python dependencies.
 RUN echo "cachebust=$CACHEBUST" && pip install --upgrade --no-cache-dir -r requirements.txt
 
 # Copy application code
diff --git a/requirements.txt b/requirements.txt
index 9fb9e64..1cbb9c0 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -3,8 +3,12 @@ fastapi>=0.115.0
 uvicorn[standard]>=0.24.0
 python-multipart>=0.0.6
 
-# SDRF validation (use GitHub to match app imports)
-git+https://github.com/bigbio/sdrf-pipelines.git
+# Pin a released wheel so /health.sdrf_pipelines_version is stable and the
+# image vendors the matching sdrf-templates (0.1.6: environmental medium
+# required; environmental sample type no longer required). An unpinned git
+# URL reports whatever tag was latest at image-build time, which is why
+# production is still on 0.1.5.
+sdrf-pipelines==0.1.6
 
 # Utilities
 pydantic>=2.0.0

From 6d1be10ca83467eefcd5f3b5795d20642295b806 Mon Sep 17 00:00:00 2001
From: Nithu John <85367999+nithujohn@users.noreply.github.com>
Date: Wed, 19 Aug 2026 11:51:38 +0100
Subject: [PATCH 2/3] Leave the CI workflow file unchanged.

The fork push is blocked without the GitHub workflow OAuth scope; the
requirements pin and Dockerfile comment are enough for the version bump.

Co-authored-by: Cursor <cursoragent@cursor.com>
---
 .github/workflows/docker-build.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/docker-build.yaml b/.github/workflows/docker-build.yaml
index 9422afa..7a36f3b 100644
--- a/.github/workflows/docker-build.yaml
+++ b/.github/workflows/docker-build.yaml
@@ -58,7 +58,7 @@ jobs:
           cache-from: type=gha
           cache-to: type=gha,mode=max
           # Pass the commit SHA as CACHEBUST so the pip-install layer always
-          # re-runs against the pinned requirements.txt.
+          # re-runs and unpinned VCS deps (sdrf-pipelines main HEAD) are refreshed.
           build-args: |
             CACHEBUST=${{ github.sha }}
 

From d0233c75dfa6fab51eef0b74b018ed47b0e46c2c Mon Sep 17 00:00:00 2001
From: Nithu John <85367999+nithujohn@users.noreply.github.com>
Date: Thu, 20 Aug 2026 15:02:10 +0100
Subject: [PATCH 3/3] Update sdrf-pipelines version in requirements.txt

Updated sdrf-pipelines to version 0.1.6.
---
 requirements.txt | 1 -
 1 file changed, 1 deletion(-)

diff --git a/requirements.txt b/requirements.txt
index 1cbb9c0..5873952 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -7,7 +7,6 @@ python-multipart>=0.0.6
 # image vendors the matching sdrf-templates (0.1.6: environmental medium
 # required; environmental sample type no longer required). An unpinned git
 # URL reports whatever tag was latest at image-build time, which is why
-# production is still on 0.1.5.
 sdrf-pipelines==0.1.6
 
 # Utilities