From e54f6da69cab41d87d1fe2d487bbcb0650e02fd6 Mon Sep 17 00:00:00 2001
From: JS Ng <ngjunsiang@gmail.com>
Date: Wed, 7 Oct 2026 13:02:59 +0800
Subject: [PATCH] Pin prod runtime to Python 3.13; document Python tier split
 in CI
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Railway/Nixpacks reads .python-version, so the prod runtime can no
longer float onto a bugfix or EOL release — the support policy forbids
compatibility-testing bugfix releases in prod. Un-ignore .python-version
(classroom already tracks one) and pin 3.13, matching the devcontainer
and CI. The ci.yml comment now reflects that campus-suite weekly and
campus-api-python main declare <3.15 (they CI-test bugfix-tier 3.14
allow-fail) while admin stays security-tier only.
---
 .github/workflows/ci.yml | 9 ++++++---
 .gitignore               | 5 ++---
 .python-version          | 1 +
 3 files changed, 9 insertions(+), 6 deletions(-)
 create mode 100644 .python-version

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index fae2e71..6c33ca2 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -38,9 +38,12 @@ jobs:
         with:
           version: '0.16.9'
 
-  # Stage 1: install + app-factory smoke test. The Python matrix mirrors the
-  # supported range of the tracked Campus packages (campus-suite weekly and
-  # campus-api-python main both declare >=3.11,<3.14); keep the three in sync.
+  # Stage 1: install + app-factory smoke test. The Python matrix covers the
+  # security tier (3.11-3.13): officially supported per the campus Python
+  # support policy. campus-suite weekly and campus-api-python main declare
+  # >=3.11,<3.15 because they additionally CI-test bugfix-tier 3.14
+  # (allow-to-fail); admin supports the security tier only. Keep the
+  # security-tier part of the range in sync across the three.
   smoke:
     name: Smoke Test (${{ matrix.python-version }})
     needs: ruff
diff --git a/.gitignore b/.gitignore
index b37824c..4352597 100644
--- a/.gitignore
+++ b/.gitignore
@@ -83,9 +83,8 @@ profile_default/
 ipython_config.py
 
 # pyenv
-#   For a library or package, you might want to ignore these files since the code is
-#   intended to run in multiple environments; otherwise, check them in:
-.python-version
+#   .python-version IS tracked here: it pins the Railway/Nixpacks prod
+#   runtime to a security-tier release (campus Python support policy).
 
 # pipenv
 #   According to pypa/pipenv#598, it is recommended to include Pipfile.lock in version control.
diff --git a/.python-version b/.python-version
new file mode 100644
index 0000000..24ee5b1
--- /dev/null
+++ b/.python-version
@@ -0,0 +1 @@
+3.13