Release: BIDS widget CORS preview origins (v0.8.5)

.github/workflows/sync-develop.yml

@@ -30,15 +30,27 @@ jobs:
     if: github.event.workflow_run.conclusion == 'success'
     runs-on: ubuntu-latest
     steps:
-      - name: Checkout develop
+      # Check out main, not develop: under the workflow_run trigger the
+      # checkout action's wildcard fetch (+refs/heads/*) intermittently
+      # advertises only `main`, so `ref: develop` fails with "a branch or tag
+      # with the name 'develop' could not be found" (broke every release through
+      # v0.8.4). main is always advertised; we fetch develop by explicit name
+      # in the next step, which requests the ref directly and is reliable.
+      - name: Checkout main
         uses: actions/checkout@v4
         with:
-          ref: develop
+          ref: main
           fetch-depth: 0
           # CI_ADMIN_TOKEN lets this push to develop without tripping
           # branch protection (same pattern as ensure-stable-version.yml).
           token: ${{ secrets.CI_ADMIN_TOKEN }}
 
+      - name: Check out develop by explicit ref
+        run: |
+          git fetch origin +refs/heads/develop:refs/remotes/origin/develop
+          git checkout -B develop refs/remotes/origin/develop
+          git log --oneline -1
+
       - name: Set up Python
         uses: actions/setup-python@v5
         with:

src/assistants/bids/config.yaml

@@ -20,6 +20,12 @@ enable_page_context: true
 cors_origins:
   - https://bids.neuroimaging.io
   - https://bids-specification.readthedocs.io
+  # Temporary: ReadTheDocs PR preview builds, so reviewers can try the widget
+  # before merge. Remove once these PRs are merged:
+  #   bids-standard/bids-specification#2442  (spec site)
+  #   bids-standard/bids-website#847         (website)
+  - https://bids-specification--2442.org.readthedocs.build
+  - https://bids-website--847.org.readthedocs.build
 
 # Per-community OpenRouter API key (optional)
 openrouter_api_key_env_var: "OPENROUTER_API_KEY_BIDS"

src/version.py

@@ -1,7 +1,7 @@
 """Version information for OSA."""
 
-__version__ = "0.8.4"
-__version_info__ = (0, 8, 4)
+__version__ = "0.8.5.dev2"
+__version_info__ = (0, 8, 5, "dev2")
 
 
 def get_version() -> str:

workers/osa-worker/index.js

@@ -158,7 +158,9 @@ function isAllowedOrigin(origin) {
   const allowedPatterns = [
     'https://osc.earth',
     'https://*.mne.tools',
+    'https://bids-specification--2442.org.readthedocs.build',
     'https://bids-specification.readthedocs.io',
+    'https://bids-website--847.org.readthedocs.build',
     'https://bids.neuroimaging.io',
     'https://eeglab.org',
     'https://fieldtriptoolbox.org',
@@ -188,6 +190,7 @@ function isAllowedOrigin(origin) {
   if (origin.startsWith('https://') && origin.endsWith('.mne.tools')) return true;
   if (origin.startsWith('https://') && origin.endsWith('.nemar.org')) return true;
   if (origin.startsWith('https://') && origin.endsWith('.neuroimaging.io')) return true;
+  if (origin.startsWith('https://') && origin.endsWith('.readthedocs.build')) return true;
   if (origin.startsWith('https://') && origin.endsWith('.readthedocs.io')) return true;
 
   // Allow demo.osc.earth and single-level subdomains (develop-demo, PR previews)