[github-actions]

@maverbiest wants to update the staging deployment from pathoplexus/pathoplexus@caa4f5a to pathoplexus/pathoplexus@cfeca30.

Commit date: 2026-10-23T09:35:59Z

Changelog

• Update Loculus version to 3a614e pathoplexus#1204

Comparison

pathoplexus/pathoplexus@caa4f5a...cfeca30

Pre-merge checklists

Before merging this PR and bumping the staging version, clone the production database to staging and confirm this was successful:

• DB clone: ssh bastion "cd pathoplexus/scripts/db-clone/ && ./clone-prod-to-staging.sh"
• Restart staging backend: kubectl rollout restart deployment/loculus-backend -n staging
• Run regressions tests to confirm staging is now identical to production (you will need to wait for SILO pods to import any new data)
  • already done here: Bump staging to ce321e #877

Post-merge checklists

After merging this PR, work through these checks (or provide justification for anything that was skipped) to confirm functionality and data integrity of Pathoplexus under the new version.

Standard checklist:

• Run regression tests, highlight any observed differences and discuss why they are expected. If the new version includes new preprocessing pipeline versions: wait for reprocessing to finish and for all new SILO pods to come up first
  • already done here: Bump staging to ce321e #877
• Confirm submit/revise/revoke flow works (also pay close attention to the UI, document anything out of the ordinary):
  • Submit test data to the staging preview
    • Confirm submission goes through (CCHF: PP_0082DBM.1, WNV: PP_0082DCK.1, PP_0082DDH.1, PP_0082DEF.1, ...)
  • Revise a test sequence (revising PP_0082DBM.1)
    • Confirm revision goes through
  • Revoke a test sequence (revoking PP_0082DCK.1)
    • Confirm revocation goes through

Rollout-specific checklist:

(mostly already done on #877)

• direct submission PP_00779BG with umbrella bioproject: the bioprojectAccession needs to be set to null in submitted_data (kept in archive)

  • Did this manually via pgAdmin GUI: deleted the bioprojectAccession from submitted_data but kept it in the archive

• Ensure the website’s OIDC transaction-cookie encryption secret is available

• After all replicas are running the new version:
  Verify login, registration, return to the requested page, and logout.

• Apply the Keycloak changes documented under User administration → Update browser authentication settings on an existing realm:

  • Replace wildcard login redirect URIs with the exact /auth/callback URL.
    Configure the exact /logout post-logout redirect URL.
  • Set Proof Key for Code Exchange Code Challenge Method to S256.

• Verify login and logout again after saving the Keycloak settings.

• Check errors & wanrings of external accession validation

• Ensure missing specimenCollectorSampleId no longer adds multiple warnings to it's input fields. (see https://loculus.slack.com/archives/C05G172HL6L/p1792745425456729)