From fe8f5b8f9bbf7c31896b7627f6a1f0d9a2e24236 Mon Sep 17 00:00:00 2001
From: Pigbibi <20649888+Pigbibi@users.noreply.github.com>
Date: Wed, 1 Jul 2026 01:32:25 +0800
Subject: [PATCH 1/2] fix: use constraints.txt in Dockerfile

---
 .github/workflows/sync-cloud-run-env.yml | 5 +++++
 Dockerfile                               | 3 ++-
 2 files changed, 7 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/sync-cloud-run-env.yml b/.github/workflows/sync-cloud-run-env.yml
index 59739ca..63fa255 100644
--- a/.github/workflows/sync-cloud-run-env.yml
+++ b/.github/workflows/sync-cloud-run-env.yml
@@ -219,6 +219,11 @@ jobs:
           project_id: ${{ env.GCP_PROJECT_ID }}
           version: ">= 416.0.0"
 
+      - name: 
+      - name: Download constraints
+        if: steps.config.outputs.deploy_enabled == 'true'
+        run: curl -sL https://raw.githubusercontent.com/QuantStrategyLab/QuantPlatformKit/main/constraints.txt -o constraints.txt
+
       - name: Build, push, and deploy Cloud Run image
         if: steps.deploy_config.outputs.enabled == 'true'
         run: |
diff --git a/Dockerfile b/Dockerfile
index 0e6541a..3bd9434 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -11,8 +11,9 @@ RUN apt-get update \
     && rm -rf /var/lib/apt/lists/*
 
 COPY requirements.txt ./
+COPY constraints.txt ./
 RUN python -m pip install --upgrade pip \
-    && python -m pip install -r requirements.txt \
+    && python -m pip install -r requirements.txt -c constraints.txt \
     && apt-get purge -y git \
     && apt-get autoremove -y --purge \
     && rm -rf /var/lib/apt/lists/*

From 60b9223b96137e76aad226353abbf2d13161e9ef Mon Sep 17 00:00:00 2001
From: Pigbibi <20649888+Pigbibi@users.noreply.github.com>
Date: Wed, 1 Jul 2026 01:33:46 +0800
Subject: [PATCH 2/2] feat: add constraints.txt

---
 constraints.txt | 14 ++++++++++++++
 1 file changed, 14 insertions(+)
 create mode 100644 constraints.txt

diff --git a/constraints.txt b/constraints.txt
new file mode 100644
index 0000000..dc4783c
--- /dev/null
+++ b/constraints.txt
@@ -0,0 +1,14 @@
+# QSL Dependency Constraints — SINGLE SOURCE OF TRUTH
+# All repos MUST reference this file for git-based dependency SHAs.
+# Generated: 2026-07-01
+# Auto-updated by update-qpk-pin.yml on every push to QPK main.
+
+quant-platform-kit @ git+https://github.com/QuantStrategyLab/QuantPlatformKit.git@a9085d6d46147f62b80bbd441d19d85acaa3dda6
+us-equity-strategies @ git+https://github.com/QuantStrategyLab/UsEquityStrategies.git@635f64207a9db8dc7af51e7ad496557a57be5579
+hk-equity-strategies @ git+https://github.com/QuantStrategyLab/HkEquityStrategies.git@5fb48ea102c28deb6dd1c9674553f3c77aba4f2c
+cn-equity-strategies @ git+https://github.com/QuantStrategyLab/CnEquityStrategies.git@e09fd557c2bd9ae5f4d44228915c4e52c4b0dd21
+crypto-strategies @ git+https://github.com/QuantStrategyLab/CryptoStrategies.git@565be005e4186fd6d750884e7b0bc59f779f9549
+quantuscombostrategies @ git+https://github.com/QuantStrategyLab/QuantUsComboStrategies.git@d35f4f86b09a7f4e99a1f83c973b21f2420398ef
+quanthkcombostrategies @ git+https://github.com/QuantStrategyLab/QuantHkComboStrategies.git@dfc21e923c0f9ba54678a75d0edc96a56e2188e2
+quantcncombostrategies @ git+https://github.com/QuantStrategyLab/QuantCnComboStrategies.git@1172e77e8046088c2bab2880343786ec135539da
+quantcryptocombostrategies @ git+https://github.com/QuantStrategyLab/QuantCryptoComboStrategies.git@475c5259d3ba7e2dcd4de30aaa96437142669a1c