Prbatero/feat/data publishing local

.github/scripts/check_env_drift.py

@@ -41,6 +41,13 @@
 
 PLACEHOLDER = re.compile(r"<[^<>]+>")
 
+# Typed wrappers around os.getenv (e.g. `_get_bool_env`,
+# `_get_bounded_int_env` in hastegeo.core.config). They take the variable name
+# as the first argument and supply their own default in the signature, so a
+# call is a genuine read even when no default is passed at the call site.
+# Without this the scanner sees no reader and reports the setting as dead.
+ENV_HELPER = re.compile(r"^_get_[a-z0-9_]*env$")
+
 # Variables that are genuinely optional for an Azure deployment, with the reason
 # each one is exempt. Anything not listed here that the code marks required must
 # be emitted by both deploy paths.
@@ -126,6 +133,11 @@ def scan_code() -> tuple[dict[str, set[Path]], set[str]]:
                         and func.attr in ("getenv", "get")
                         and node.args
                     )
+                    is_helper = (
+                        isinstance(func, ast.Name)
+                        and ENV_HELPER.match(func.id)
+                        and node.args
+                    )
                     if is_getenv:
                         target = ast.unparse(func)
                         if target.endswith(
@@ -135,6 +147,13 @@ def scan_code() -> tuple[dict[str, set[Path]], set[str]]:
                             has_default = len(node.args) > 1
                             if has_default:
                                 default = _literal(node.args[1])
+                    elif is_helper:
+                        name = _literal(node.args[0])
+                        # The wrapper defines its own default, so the read is
+                        # optional even with no default at the call site.
+                        has_default = True
+                        if len(node.args) > 1:
+                            default = _literal(node.args[1])
 
                 elif isinstance(node, ast.Subscript):
                     value = node.value

.github/scripts/deploy_apps.sh

@@ -56,6 +56,9 @@ BATCH_INFERENCE_POOL_IDS="${BATCH_INFERENCE_POOL_IDS:-}"
 BATCH_IMAGERYPREP_POOL_IDS="${BATCH_IMAGERYPREP_POOL_IDS:-}"
 BATCH_USE_SAS="${BATCH_USE_SAS:-false}"
 BATCH_MANAGE_POOLS="${BATCH_MANAGE_POOLS:-true}"
+# Data publishing feature flag. Mirrors the `publishingEnabled` param in
+# infra/modules/functions.bicep so both deploy paths agree; defaults off.
+PUBLISHING_ENABLED="${PUBLISHING_ENABLED:-false}"
 MAPS_ACCOUNT="${RESOURCE_PREFIX}haste${RANDOM_SUFFIX}maps"
 API_MANAGEMENT="${RESOURCE_PREFIX}-haste-${RANDOM_SUFFIX}-apim"
 FIXED_TAGS="project=haste created_by=deploy_apps"
@@ -135,6 +138,7 @@ deploy_function() {
             "STATIC_APP_DOMAIN=${STATIC_APP_DOMAIN}" \
             "EMAIL_CONNECTION_STRING=${EMAIL_CONNECTION_STRING}" \
             "EMAIL_SENDER=${EMAIL_SENDER}" \
+            "PUBLISHING_ENABLED=${PUBLISHING_ENABLED}" \
             --output none
     fi
 

.github/workflows/deploy-apps.yml

@@ -111,6 +111,10 @@ jobs:
           # Non-sensitive UI feature flag, baked into the Vite bundle at build time.
           # Set as a GitHub Environment variable; defaults to false when unset.
           VITE_SHOW_FOOTER: ${{ vars.VITE_SHOW_FOOTER }}
+          # Non-sensitive data-publishing feature flag, mirroring the
+          # `publishingEnabled` param on the Bicep path. Set as a GitHub
+          # Environment variable; defaults to false when unset.
+          PUBLISHING_ENABLED: ${{ vars.PUBLISHING_ENABLED }}
           # hastegeo wheel pinned into the function-app requirements before
           # `func publish` (deploy_apps.sh); the editable default can't resolve
           # on Azure's remote build.