Gosec

.github/workflows/cd.yml

@@ -0,0 +1,38 @@
+name : cd
+
+on:
+    push:
+      branches: [main]
+
+jobs:
+    deploy:
+        name: init cd
+        runs-on: ubuntu-latest
+
+        steps:
+            - name: Set up Go
+              uses: actions/setup-go@v4
+              with:
+                go-version: '1.20'
+
+            - name: Check out code
+              uses: actions/checkout@v3
+
+            - name: Build app with script
+              run:  scripts/buildprod.sh
+    gcp-run:  
+
+        name: run cd
+        runs-on: ubuntu-latest
+
+        steps:
+              - id: 'auth'
+                uses: 'google-github-actions/auth@v1'
+                with:
+                 credentials_json: '${{ secrets.GCP_CREDENTIALS }}'
+
+              - name: 'Set up Cloud SDK'
+                uses: 'google-github-actions/setup-gcloud@v1'
+
+              - name: 'Use gcloud CLI'
+                run: 'gcloud info'

.github/workflows/ci.yml

@@ -0,0 +1,53 @@
+name: ci
+
+on:
+  pull_request:
+    branches: [main]
+
+jobs:
+  tests:
+    name: tests
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Set up Go
+        uses: actions/setup-go@v4
+        with:
+          go-version: '1.20'
+
+      - name: Check out code
+        uses: actions/checkout@v3
+
+      - name:  Echo Go version
+        run: go test ./... -cover
+
+
+      - name: install gosec
+        run: go install github.com/securego/gosec/v2/cmd/gosec@latest
+
+      - name: run gosec
+        run : gosec ./...
+
+
+  Formatting:
+     name: apply formatting
+     runs-on: ubuntu-latest
+
+     steps:
+      - name: Set up Go
+        uses: actions/setup-go@v4
+        with:
+         go-version: '1.20'
+
+      - name: Check out code
+        uses: actions/checkout@v3
+
+      - name: Return format error code
+        run: test -z $(go fmt ./...)
+
+      - name: install staticcheck
+        run: go install honnef.co/go/tools/cmd/staticcheck@latest
+
+      - name: run staticcheck
+        run: staticcheck ./...
+

.vscode/settings.json

@@ -0,0 +1,3 @@
+{
+  "workbench.settings.openDefaultSettings": false
+}

Dockerfile

@@ -4,4 +4,6 @@ RUN apt-get update && apt-get install -y ca-certificates
 
 ADD notely /usr/bin/notely
 
+RUN gcloud builds submit --tag us-central1-docker.pkg.dev/notely-393407/notely-ar-repo/1.0 .
+
 CMD ["notely"]

README.md

@@ -1,3 +1,7 @@
+![code coverage badge](https://github.com/tb38r/learn-cicd-starter/actions/workflows/ci.yml/badge.svg)
+
+
+
 # learn-cicd-starter (Notely)
 
 This repo contains the starter code for the "Notely" application for the "Learn CICD" course on [Boot.dev](https://boot.dev).
@@ -21,3 +25,6 @@ go build -o notely && ./notely
 *This starts the server in non-database mode.* It will serve a simple webpage at `http://localhost:8000`.
 
 You do *not* need to set up a database or any interactivity on the webpage yet. Instructions for that will come later in the course!
+
+
+-- Ignore this line --

internal/auth/auth.go

@@ -7,6 +7,7 @@ import (
 )
 
 var ErrNoAuthHeaderIncluded = errors.New("no authorization header included")
+var ErrMalFormed = errors.New("malformed authorization header")
 
 // GetAPIKey -
 func GetAPIKey(headers http.Header) (string, error) {
@@ -15,8 +16,9 @@ func GetAPIKey(headers http.Header) (string, error) {
 		return "", ErrNoAuthHeaderIncluded
 	}
 	splitAuth := strings.Split(authHeader, " ")
+
 	if len(splitAuth) < 2 || splitAuth[0] != "ApiKey" {
-		return "", errors.New("malformed authorization header")
+		return "", ErrMalFormed
 	}
 
 	return splitAuth[1], nil

internal/auth/auth_test.go

@@ -0,0 +1,42 @@
+package auth
+
+import (
+	"net/http"
+	"testing"
+)
+
+func TestGetAPIKey(t *testing.T) {
+
+	// Case 1: No authorization header included
+	headers := http.Header{}
+	key, err := GetAPIKey(headers)
+	if err != ErrNoAuthHeaderIncluded {
+		t.Errorf("expected ErrNoAuthHeaderIncluded, got %v", err)
+	}
+	if key != "" {
+		t.Errorf("expected key to be empty, got %v", key)
+	}
+
+	// Case 2: Malformed authorization header
+	headers.Add("Authorization", "ApiKey")
+
+	_, err = GetAPIKey(headers)
+
+	var errMessage = ErrMalFormed
+
+	if err != ErrMalFormed {
+		t.Errorf("expected %v , got %v", errMessage, err)
+	}
+
+	// Case 3: Valid authorization header
+	headers.Del("Authorization")
+	headers.Add("Authorization", "ApiKey my-api-key")
+	key, err = GetAPIKey(headers)
+	if err != nil {
+		t.Errorf("unexpected error: %v", err)
+	}
+	if key != "my-api-key" {
+		t.Errorf("expected key to be 'my-api-key', got %v", key)
+	}
+
+}

json.go

@@ -27,5 +27,15 @@ func respondWithJSON(w http.ResponseWriter, code int, payload interface{}) {
 		return
 	}
 	w.WriteHeader(code)
-	w.Write(dat)
+	val, err := w.Write(dat)
+	handleWriteError(w, err)
+	log.Printf("Wrote %d bytes to response", val)
+
+}
+
+func handleWriteError(w http.ResponseWriter, err error) {
+	if err != nil {
+		log.Printf("Error writing to response: %v", err)
+		http.Error(w, err.Error(), http.StatusInternalServerError)
+	}
 }

main.go

@@ -9,6 +9,7 @@ import (
 	"net/url"
 	"os"
 	"strings"
+	"time"
 
 	"github.com/go-chi/chi"
 	"github.com/go-chi/cors"
@@ -23,6 +24,8 @@ type apiConfig struct {
 	DB *database.Queries
 }
 
+// nada
+//
 //go:embed static/*
 var staticFiles embed.FS
 
@@ -93,8 +96,9 @@ func main() {
 
 	router.Mount("/v1", v1Router)
 	srv := &http.Server{
-		Addr:    ":" + port,
-		Handler: router,
+		Addr:              ":" + port,
+		Handler:           router,
+		ReadHeaderTimeout: 1 * time.Second,
 	}
 
 	log.Printf("Serving on port: %s\n", port)

vendor/modules.txt

@@ -1,3 +1,5 @@
+# github.com/BurntSushi/toml v1.2.1
+## explicit; go 1.16
 # github.com/go-chi/chi v1.5.4
 ## explicit; go 1.16
 github.com/go-chi/chi
@@ -7,9 +9,37 @@ github.com/go-chi/cors
 # github.com/go-sql-driver/mysql v1.7.1
 ## explicit; go 1.13
 github.com/go-sql-driver/mysql
+# github.com/google/go-cmp v0.5.9
+## explicit; go 1.13
 # github.com/google/uuid v1.3.0
 ## explicit
 github.com/google/uuid
 # github.com/joho/godotenv v1.5.1
 ## explicit; go 1.12
 github.com/joho/godotenv
+# github.com/sergi/go-diff v1.1.0
+## explicit; go 1.12
+# golang.org/x/exp v0.0.0-20220722155223-a9213eeb770e
+## explicit; go 1.18
+# golang.org/x/exp/typeparams v0.0.0-20221212164502-fae10dda9338
+## explicit; go 1.18
+# golang.org/x/mod v0.11.0
+## explicit; go 1.17
+# golang.org/x/sync v0.3.0
+## explicit; go 1.17
+# golang.org/x/sys v0.9.0
+## explicit; go 1.17
+# golang.org/x/text v0.10.0
+## explicit; go 1.17
+# golang.org/x/tools v0.10.1-0.20230622221742-0622ad2359a7
+## explicit; go 1.18
+# golang.org/x/tools/gopls v0.12.4
+## explicit; go 1.18
+# golang.org/x/vuln v0.0.0-20230110180137-6ad3e3d07815
+## explicit; go 1.18
+# honnef.co/go/tools v0.4.2
+## explicit; go 1.19
+# mvdan.cc/gofumpt v0.4.0
+## explicit; go 1.18
+# mvdan.cc/xurls/v2 v2.4.0
+## explicit; go 1.16