fix: CORS startup crash + path traversal security #32

	name: Sync to Hugging Face

	on:
	push:
	branches:
	- main

	jobs:
	sync:
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@v4
	with:
	fetch-depth: 0
	lfs: true

	- name: Fetch all LFS objects
	run: git lfs pull

	- uses: actions/setup-python@v5
	with:
	python-version: '3.12'

	- name: Inject HuggingFace metadata into README
	run: \|
	HF_HEADER="---
	title: Eurus
	emoji: 🌊
	colorFrom: purple
	colorTo: blue
	sdk: docker
	pinned: false
	---
	"
	# Remove leading spaces from heredoc indentation
	HF_HEADER=$(echo "$HF_HEADER" \| sed 's/^ //')
	echo "$HF_HEADER" \| cat - README.md > README_hf.md
	mv README_hf.md README.md

	- name: Push to Hugging Face
	env:
	HF_TOKEN: ${{ secrets.HF_TOKEN }}
	run: \|
	pip install -U huggingface_hub
	python -c "
	from huggingface_hub import HfApi
	import os
	api = HfApi()
	token = os.environ['HF_TOKEN']
	for repo_id in ['CliDyn/Eurus', 'dmpantiu/Eurus']:
	print(f'Uploading to {repo_id}...')
	api.upload_folder(
	folder_path='.',
	repo_id=repo_id,
	repo_type='space',
	token=token,
	ignore_patterns=['.git/', '.github/'],
	)
	print(f'Upload to {repo_id} complete')
	print('All uploads complete')
	"

Provide feedback