chore: update dependabot-auto-merge.yml

.github/dependabot-auto-merge.yml

@@ -0,0 +1,17 @@
+name: Dependabot Auto-Merge
+on: pull_request
+
+permissions:
+  contents: write
+  pull-requests: write
+
+jobs:
+  auto-merge:
+    runs-on: ubuntu-latest
+    if: github.actor == 'dependabot[bot]'
+    steps:
+      - name: Enable auto-merge for Dependabot PR
+        run: gh pr merge --auto --merge "$PR_URL"
+        env:
+          PR_URL: ${{ github.event.pull_request.html_url }}
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/dependabot.yml

@@ -0,0 +1,18 @@
+version: 2
+updates:
+  - package-ecosystem: "npm"
+    directory: "/"
+    schedule:
+      interval: "daily"
+    open-pull-requests-limit: 10
+    groups:
+      production:
+        dependency-type: "production"
+        update-types:
+          - "minor"
+          - "patch"
+      development:
+        dependency-type: "development"
+        update-types:
+          - "minor"
+          - "patch"

.github/workflows/notify-parent.yml

@@ -4,6 +4,7 @@ on:
   push:
     branches:
       - main
+  workflow_dispatch:
 
 jobs:
   dispatch:

Cargo.toml

@@ -76,6 +76,15 @@ unsafe_code = "forbid"
 unused_variables = "deny"
 unused_imports = "deny"
 unused_must_use = "deny"
+dead_code = "deny"
+unused_mut = "deny"
+unreachable_code = "deny"
+trivial_casts = "deny"
+trivial_numeric_casts = "deny"
+explicit_outlives_requirements = "deny"
+unused_labels = "deny"
+unused_braces = "deny"
+noop_method_call = "deny"
 
 [lints.clippy]
 unwrap_used = "warn"
@@ -83,6 +92,7 @@ expect_used = "warn"
 panic = "deny"
 todo = "deny"
 unimplemented = "deny"
+unnecessary_to_owned = "deny"
 
 [features]
 # default = ["ffmpeg"]

src/config/mod.rs

@@ -32,8 +32,8 @@ pub struct AppConfig {
     #[serde(default = "default_env")]
     pub environment: String,
 
-    /// Allowed CORS origins (comma-separated)
-    #[serde(default)]
+    /// Allowed CORS origins (comma-separated in env var, parsed to Vec)
+    #[serde(default, deserialize_with = "deserialize_comma_separated")]
     pub cors_origins: Vec<String>,
 
     /// Log level (trace, debug, info, warn, error)
@@ -175,6 +175,19 @@ fn default_site_url() -> String {
     "https://asepharyana.my.id".to_string()
 }
 
+/// Deserialize a comma-separated string into a Vec<String>.
+/// Used for fields like cors_origins that come from a single env var.
+fn deserialize_comma_separated<'de, D>(deserializer: D) -> Result<Vec<String>, D::Error>
+where
+    D: serde::Deserializer<'de>,
+{
+    let s = String::deserialize(deserializer)?;
+    Ok(s.split(',')
+        .map(|s| s.trim().to_string())
+        .filter(|s| !s.is_empty())
+        .collect())
+}
+
 fn default_db_max_connections() -> u32 {
     100
 }
@@ -223,8 +236,7 @@ impl AppConfig {
             .add_source(
                 Environment::with_prefix("APP")
                     .separator("__")
-                    .try_parsing(true)
-                    .list_separator(","),
+                    .try_parsing(true),
             )
             // Map legacy env vars to new config structure
             .set_override_option("database_url", env::var("DATABASE_URL").ok())?