feat: use constraints.txt for deterministic deps

Author: Pigbibi

.github/workflows/ci.yml

@@ -61,7 +61,7 @@ jobs:
           python -m pip install --upgrade pip
           python -m pip install --upgrade pip
           # Install non-git packages first to avoid cross-package dependency conflicts
-          grep -vE "^\s*(#|$)|git\+" requirements.txt | xargs -r python -m pip install
+          grep -vE "^\s*(#|$)|git\+" requirements.txt | xargs -r python -m pip install -c https://raw.githubusercontent.com/QuantStrategyLab/QuantPlatformKit/fe4341b08f1f026a21ca07c4752e48ed2640cc07/constraints.txt
           # Install git-based packages individually with --no-deps
           grep 'git+' requirements.txt | while IFS= read -r pkg; do
             [ -n "$pkg" ] && python -m pip install --no-deps "$pkg"

.github/workflows/sync-cloud-run-env.yml

@@ -105,6 +105,7 @@ jobs:
       INPUT_LONGPORT_SECRET_NAME: ${{ inputs.longport_secret_name }}
       INPUT_LONGPORT_APP_KEY_SECRET_NAME: ${{ inputs.longport_app_key_secret_name }}
       INPUT_LONGPORT_APP_SECRET_SECRET_NAME: ${{ inputs.longport_app_secret_secret_name }}
+      CONSTRAINTS_URL: https://raw.githubusercontent.com/QuantStrategyLab/QuantPlatformKit/fe4341b08f1f026a21ca07c4752e48ed2640cc07/constraints.txt
       INPUT_DEPLOY_IMAGE: ${{ inputs.deploy_image }}
       INPUT_SYNC_ENV: ${{ inputs.sync_env }}
       GCP_ARTIFACT_REGISTRY_HOSTNAME: ${{ vars.GCP_ARTIFACT_REGISTRY_HOSTNAME }}
@@ -240,7 +241,8 @@ jobs:
           fi
 
           if [ "${GITHUB_EVENT_NAME:-}" = "workflow_dispatch" ] && [ "${WORKFLOW_TARGET:-configured}" = "hk-verify" ]; then
-            if [ "${INPUT_DEPLOY_IMAGE:-true}" = "true" ]; then
+            if [ "${CONSTRAINTS_URL: https://raw.githubusercontent.com/QuantStrategyLab/QuantPlatformKit/fe4341b08f1f026a21ca07c4752e48ed2640cc07/constraints.txt
+      INPUT_DEPLOY_IMAGE:-true}" = "true" ]; then
               deploy_enabled=true
             fi
             if [ "${INPUT_SYNC_ENV:-true}" = "true" ]; then
@@ -327,7 +329,8 @@ jobs:
           if [ -n "${INPUT_LONGPORT_APP_SECRET_SECRET_NAME:-}" ]; then
             echo "LONGPORT_APP_SECRET_SECRET_NAME=${INPUT_LONGPORT_APP_SECRET_SECRET_NAME}" >> "$GITHUB_ENV"
           fi
-          if [ "${INPUT_DEPLOY_IMAGE:-true}" != "true" ]; then
+          if [ "${CONSTRAINTS_URL: https://raw.githubusercontent.com/QuantStrategyLab/QuantPlatformKit/fe4341b08f1f026a21ca07c4752e48ed2640cc07/constraints.txt
+      INPUT_DEPLOY_IMAGE:-true}" != "true" ]; then
             echo "CLOUD_RUN_ENV_SYNC_WAIT_FOR_COMMIT=false" >> "$GITHUB_ENV"
           fi