From ffd477d70f7ef5ddd4890c85fcb9ef4379b903da Mon Sep 17 00:00:00 2001
From: Tom Brooks <tombrooks248@gmail.com>
Date: Fri, 12 Jun 2026 11:19:38 +0100
Subject: [PATCH] feat: add digital-alnd-python feature branch option to
 publish workflow

---
 .github/workflows/publish.yml | 14 +++++++++++++-
 Dockerfile                    |  2 ++
 2 files changed, 15 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 72d787e..08228c5 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -8,6 +8,10 @@ on:
       environment:
         type: environment
         description: The environment to deploy to.
+      digital_land_python_ref:
+        type: string
+        description: digital-land-python git ref to build against (branch, tag, or SHA).
+        default: main
 
 jobs:
   test:
@@ -40,6 +44,14 @@ jobs:
     env:
       DOCKER_REPO: ${{ secrets.DEPLOY_DOCKER_REPOSITORY }}
     steps:
+      - name: Block feature refs in production
+        run: |
+          REF="${{ inputs.digital_land_python_ref || 'main' }}"
+          if [ "$REF" != "main" ] && [ "${{ matrix.environment }}" == "production" ]; then
+            echo "::error::Refusing to deploy digital-land-python ref '$REF' to '${{ matrix.environment }}' — feature refs are not allowed in production."
+            exit 1
+          fi
+
       - uses: actions/checkout@v6
 
       - id: vars
@@ -64,7 +76,7 @@ jobs:
 
       - run: docker pull $DOCKER_REPO:${GITHUB_REF_NAME} || echo "no current latest image"
 
-      - run: docker build --build-arg DEPLOY_TIME="$(date +%Y-%m-%dT%H:%M:%S)" --build-arg GIT_COMMIT="${{ steps.vars.outputs.sha_short }}" -t $DOCKER_REPO:${{ steps.vars.outputs.sha_short }} -f ./Dockerfile .
+      - run: docker build --build-arg DIGITAL_LAND_PYTHON_REF="${{ inputs.digital_land_python_ref || 'main' }}" --build-arg DEPLOY_TIME="$(date +%Y-%m-%dT%H:%M:%S)" --build-arg GIT_COMMIT="${{ steps.vars.outputs.sha_short }}" -t $DOCKER_REPO:${{ steps.vars.outputs.sha_short }} -f ./Dockerfile .
 
       - run: docker tag $DOCKER_REPO:${{ steps.vars.outputs.sha_short }} $DOCKER_REPO:main
 
diff --git a/Dockerfile b/Dockerfile
index 2f07154..481add4 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,4 +1,5 @@
 FROM python:3.8-slim-bookworm
+ARG DIGITAL_LAND_PYTHON_REF=main
 WORKDIR /
 RUN apt-get update
 RUN apt-get upgrade -y
@@ -17,6 +18,7 @@ RUN pip install pyproj
 RUN pip install csvkit
 RUN pip install awscli
 RUN pip install --upgrade pip
+RUN sed -i "s|pipeline.git@main|pipeline.git@${DIGITAL_LAND_PYTHON_REF}|" requirements.txt
 RUN pip3 install --upgrade -r requirements.txt
 
 CMD ["./bin/run.sh"]