Fix ALLOWED_ORIGINS being silently truncated on deploy

[danibsheehan]

Summary

Found live while testing #94 locally: the Summarize button failed with "Could not summarize this page." Cloud Run logs showed only CORS preflight (`OPTIONS`, 204) — no actual `POST` ever arrived. Reproduced directly against the deployed service and found the preflight response missing `access-control-allow-origin` entirely.

Root cause: `deploy-cloudrun`'s `env_vars` input parses commas as separators between `KEY=VALUE` entries. `ALLOWED_ORIGINS`'s own value (`https://www.danibsheehan.com,http://localhost:5173\`) contains a comma, so it silently split into a valid `ALLOWED_ORIGINS=https://www.danibsheehan.com\` entry and a second, garbage, name-only entry — confirmed via `gcloud run services describe`. The deployed service has only ever had one allowed origin, on every deploy so far.

Fix

Escape the comma (`,`, per the action's own documented escaping) in a dedicated workflow step at deploy time, rather than requiring the GitHub secret itself to store a pre-escaped value — keeps the secret plain and readable as more origins get added later.

`/code-review` finding (low severity, already mitigated): escaping before writing to `GITHUB_OUTPUT` means GitHub's automatic secret-masking (which matches the literal registered secret string) won't match the escaped form if it ever appears in debug logs. Mitigated by `ALLOWED_ORIGINS` being non-sensitive by design (that's why it's a plain env var, not a Secret Manager entry) — not fixed further.

Test plan

• YAML validated, `/code-review` run
• Verified the escaping logic in bash directly: https://www.danibsheehan.com,http://localhost:5173 → https://www.danibsheehan.com\,http://localhost:5173
• After merge, confirm the redeployed service's preflight response includes `access-control-allow-origin` for both configured origins, and that Summarize actually works from local dev

🤖 Generated with Claude Code

[github-actions]

PR guide

Auto-generated from changed paths. Fill in Summary and How to verify in the PR description above.

Touches: CI / GitHub

Diff: 1 file changed, 14 insertions(+), 1 deletion(-)

Suggested verify

• Review workflow syntax and required permissions in GitHub Actions

Checklist (applies to this PR)

• No unintended secrets or local-only config committed
• Workflow permissions are scoped to the PR-guide behavior

Reviewer focus

• Workflow event triggers, token permissions, and label/comment behavior on same-repo vs fork PRs

Commits

• f874905 Fix ALLOWED_ORIGINS being silently truncated on deploy

Files by area

Area	Files
CI / GitHub	1

CI

Primary check: CI runs lint, Prettier format check, Vitest coverage, and build for every PR. Coverage tables are posted separately.

---

Template: pull_request_template.md

[github-actions]

Unit tests (Vitest)

File	Coverage	Lines	Branches
All files	54%	61%	47%	✅
src/components/DatabaseEmbedNodeView.tsx	0%	0%	0%	✅
src/components/DatabaseTableView.tsx	0%	0%	0%	✅
src/components/SlashMenu.tsx	72%	85%	60%	✅
src/context/WorkspaceContext.tsx	25%	35%	14%	✅
src/extensions/blockIdOnBlocks.ts	75%	100%	50%	✅
src/extensions/musingDatabaseEmbed.ts	70%	90%	50%	✅
src/extensions/singleTopLevelBlock.ts	80%	100%	60%	✅
src/lib/blockEditorCommands.ts	42%	50%	35%	✅
src/lib/editorBlockText.ts	13%	13%	14%	✅
src/lib/emojiSuggestionItems.ts	93%	100%	87%	✅
src/lib/htmlToDocx.ts	24%	31%	18%	✅
src/lib/pageToExportHtml.ts	97%	100%	94%	✅
src/lib/resolveWikiPage.ts	91%	100%	83%	✅
src/lib/slashMenuOptions.ts	57%	57%	0%	✅
src/lib/themePreference.ts	32%	25%	40%	✅
src/lib/workspaceStorage.ts	80%	81%	80%	✅
src/lib/pageDocument/blockGutterOps.ts	92%	100%	84%	✅
src/lib/pageDocument/blockIdAtSelection.ts	83%	100%	66%	✅
src/lib/pageDocument/lastBlockNeedsBelowHit.ts	91%	100%	83%	✅
src/lib/pageDocument/serializeDocToBlocks.ts	58%	69%	47%	✅
src/lib/pageDocument/slashMenuDeleteRange.ts	82%	95%	70%	✅
src/lib/pageDocument/tryDeleteEmptyTopLevelBlock.ts	87%	94%	81%	✅

Minimum allowed coverage is 0%

Generated by 🐒 cobertura-action against f874905