From c1543bdb5c6ede9a406c216a5898792967bdeb09 Mon Sep 17 00:00:00 2001
From: Jesse_Chen <chen.yue@mevixaga.com>
Date: Wed, 5 Aug 2026 15:16:09 +0800
Subject: [PATCH] Bound Gitea CI dependency resolution

---
 .gitea/workflows/backend-quality-gate.yml        | 8 +++++++-
 frontend/tests/staging-backend-workflows.test.ts | 9 +++++++++
 2 files changed, 16 insertions(+), 1 deletion(-)

diff --git a/.gitea/workflows/backend-quality-gate.yml b/.gitea/workflows/backend-quality-gate.yml
index 4452cbb2..a3bc99d8 100644
--- a/.gitea/workflows/backend-quality-gate.yml
+++ b/.gitea/workflows/backend-quality-gate.yml
@@ -160,7 +160,13 @@ jobs:
           python3 -m venv .venv
           export PATH="$PWD/.venv/bin:$PATH"
           python -m pip install --upgrade pip
-          python -m pip install -r requirements.txt -r requirements-dev.txt playwright
+          python -m pip install \
+            "mcp==1.28.1" \
+            "pydantic==2.13.4" \
+            "numpy==2.5.1" \
+            "pandas==2.3.3" \
+            "timezonefinder==8.2.5" \
+            -r requirements.txt -r requirements-dev.txt playwright
           python -m playwright install --with-deps chromium
           npm ci --prefix frontend
 
diff --git a/frontend/tests/staging-backend-workflows.test.ts b/frontend/tests/staging-backend-workflows.test.ts
index 72eef370..36dd5b9f 100644
--- a/frontend/tests/staging-backend-workflows.test.ts
+++ b/frontend/tests/staging-backend-workflows.test.ts
@@ -130,6 +130,15 @@ test("Gitea quality gate validates before publishing an immutable ACR manifest",
   assert.equal((workflow.match(/git clean -ffdx/g) ?? []).length, 2);
   assert.equal((workflow.match(/git status --porcelain --untracked-files=all/g) ?? []).length, 2);
   assert.match(workflow, /python3 -m venv \.venv/);
+  for (const constraint of [
+    'mcp==1.28.1',
+    'pydantic==2.13.4',
+    'numpy==2.5.1',
+    'pandas==2.3.3',
+    'timezonefinder==8.2.5',
+  ]) {
+    assert.match(workflow, new RegExp(`"${constraint.replaceAll(".", "\\.")}"`));
+  }
   assert.match(workflow, /python -m playwright install --with-deps chromium/);
   assert.equal((workflow.match(/Acquire::https::Timeout=30 update/g) ?? []).length, 1);
   assert.match(workflow, /packages\+=\(docker-compose-v2\)/);