Deploy code feature

.github/workflows/trigger-deploy-on-merge.yml

@@ -0,0 +1,36 @@
+name: Trigger Deployment on Pull Request Merge
+on:
+    pull_request:
+        types: [closed]
+        branches: [ develop, staging, production]
+permissions:
+    contents: read
+    actions: write
+jobs:
+    on-merge:
+        if: github.event.pull_request.merged == true
+        runs-on: ubuntu-latest
+        outputs:
+            environment: ${{ steps.set-environment.outputs.environment }}
+        steps:
+            - name: Set Environment
+              id: set-environment
+              run: |
+                case "${{ github.base_ref }}" in
+                    develop)    echo "environment=develop" >> $GITHUB_OUTPUT ;;
+                    staging)    echo "environment=staging" >> $GITHUB_OUTPUT ;;
+                    production) echo "environment=production" >> $GITHUB_OUTPUT ;;
+                    testing)    echo "environment=testing" >> $GITHUB_OUTPUT ;;
+                esac
+    deploy:
+        needs: on-merge
+        runs-on: ubuntu-latest
+        env:
+            GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        steps:
+            - name: Trigger Deployment Workflow
+              run: |
+                gh workflow run push-docker-image.yml \
+                    --repo ${{ github.repository }} \
+                    --ref ${{ github.base_ref }} \
+                    --field environment=${{ needs.on-merge.outputs.environment }}

api/core/config.py

@@ -10,11 +10,9 @@ class Settings(BaseSettings):
 
     PROJECT_NAME: str = "Workspaces API"
 
-    # JSON array of allowed CORS origins. For example:
-    #
-    #   ["https://workspaces.example.com", "https://leaderboard.example.com"]
-    #
-    CORS_ORIGINS: list[str] = []
+    # Comma separated list of origins, or "*" to allow all origins. Defaults to an empty list.
+    # Example: CORS_ORIGINS="https://workspaces.example.com,https://leaderboard.example.com"
+    CORS_ORIGINS: str = ""
 
     TASK_DATABASE_URL: str = (
         "postgresql+asyncpg://user:pass@localhost:5432/tasking_manager"

api/main.py

@@ -97,7 +97,9 @@ async def lifespan(_app: FastAPI):
 
 app.add_middleware(
     CORSMiddleware,
-    allow_origins=settings.CORS_ORIGINS,
+    allow_origins=[
+        origin.strip() for origin in settings.CORS_ORIGINS.split(",") if origin.strip()
+    ],
     allow_credentials=True,
     allow_methods=["*"],
     allow_headers=["*"],

tests/unit/test_config.py

@@ -14,7 +14,7 @@ def test_defaults_loaded_when_env_unset():
     s = Settings(_env_file=None)  # type: ignore[call-arg]  # pydantic-settings init kwarg
 
     assert s.PROJECT_NAME == "Workspaces API"
-    assert s.CORS_ORIGINS == []
+    assert s.CORS_ORIGINS == ""
     assert s.DEBUG is False
     assert s.SENTRY_DSN == ""
     assert s.WS_OSM_HOST == "http://osm-web"
@@ -38,18 +38,18 @@ def test_env_vars_override_members(monkeypatch):
 
 
 def test_cors_origins_parsed_from_json_env(monkeypatch):
-    monkeypatch.setenv("CORS_ORIGINS", '["https://a.example", "https://b.example"]')
+    monkeypatch.setenv("CORS_ORIGINS", "https://a.example,https://b.example")
 
     s = Settings(_env_file=None)  # type: ignore[call-arg]  # pydantic-settings init kwarg
 
-    assert s.CORS_ORIGINS == ["https://a.example", "https://b.example"]
+    assert s.CORS_ORIGINS == "https://a.example,https://b.example"
 
 
 def test_value_types_and_formats():
     s = Settings(_env_file=None)  # type: ignore[call-arg]  # pydantic-settings init kwarg
 
     assert isinstance(s.PROJECT_NAME, str)
-    assert isinstance(s.CORS_ORIGINS, list)
+    assert isinstance(s.CORS_ORIGINS, str)
     assert isinstance(s.DEBUG, bool)
     # empty-string default is preserved (not coerced to None):
     assert s.SENTRY_DSN == ""