Drills: Deploy & CI

.github/workflows/ci.yml

name: CI

on: [push]

jobs:
  test:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with:
          python-version: "3.12"
      - run: pip install -r requirements.txt
      - run: pytest -q

The file lives at that exact path — GitHub discovers any .yml under .github/workflows/ automatically.

# Vercel (frontend)
NEXT_PUBLIC_API_URL   # the public backend URL the browser calls

# Render / Railway / Fly.io (backend)
DATABASE_URL          # the Neon Postgres connection string
OPENAI_API_KEY        # RAG embeddings + LLM calls
JWT_SECRET            # signs/verifies auth tokens
FRONTEND_ORIGIN       # the Vercel domain, used for CORS

Only NEXT_PUBLIC_API_URL is browser-exposed. The rest are server-side secrets and must never carry the NEXT_PUBLIC_ prefix or land in git.

from fastapi.middleware.cors import CORSMiddleware

app.add_middleware(
    CORSMiddleware,
    allow_origins=["https://docchat.vercel.app"],
    allow_credentials=True,
    allow_methods=["*"],
    allow_headers=["*"],
)

Use the exact scheme + host, no trailing slash. Don't ship allow_origins=["*"] with credentials — browsers reject that combination.

# 1. Push the repo to GitHub.
# 2. vercel.com -> Import Project -> pick the repo.
#    Vercel auto-detects Next.js (no build config needed).
# 3. Settings -> Environment Variables:
#       NEXT_PUBLIC_API_URL = https://docchat-api.onrender.com
# 4. Deploy. Every later `git push` to main auto-deploys;
#    every pull request gets its own preview URL.

No deploy command by hand — the GitHub connection makes push the trigger.

# 1. Ensure the repo has the Dockerfile from Lesson 7.1.
#    CMD: uvicorn app.main:app --host 0.0.0.0 --port $PORT
# 2. Render -> New -> Web Service -> connect the repo.
#    Render detects the Dockerfile and builds the image.
# 3. Set env vars in the dashboard:
#       DATABASE_URL, OPENAI_API_KEY, JWT_SECRET, FRONTEND_ORIGIN
# 4. Deploy -> Render gives an HTTPS URL (TLS automatic).
# 5. Run migrations once: alembic upgrade head against DATABASE_URL.

Bind to 0.0.0.0 and the host's $PORT — not 127.0.0.1:8000, which only works locally.

# DocChat go-live checklist
# [ ] .env is gitignored; no secrets committed anywhere
# [ ] Neon: create project, copy DATABASE_URL
# [ ] alembic upgrade head  (against the Neon DATABASE_URL)
# [ ] Render: connect repo, set DATABASE_URL, OPENAI_API_KEY,
#     JWT_SECRET, FRONTEND_ORIGIN -> deploy -> note API URL
# [ ] CORS allow_origins includes the Vercel domain -> push
# [ ] Vercel: import repo, set NEXT_PUBLIC_API_URL=API URL -> deploy
# [ ] Smoke test: sign up, upload a doc, ask a question end-to-end
# [ ] CI green on main

.github/workflows/ci.yml

name: CI

on:
  push:
    branches: [main]
  pull_request:

jobs:
  test:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with:
          python-version: "3.12"
      - name: Install dependencies
        run: pip install -r requirements.txt
      - name: Lint
        run: ruff check .
      - name: Run tests
        run: pytest -q

Order matters: database before backend, backend URL before the frontend env var, CORS before the first real browser call. The CI file makes every future push prove itself.