corrected code and gosec checks

.github/workflows/cd.yml

@@ -0,0 +1,72 @@
+name: cd
+
+on:
+  push:
+    branches: [main]
+
+jobs:
+  deploy:
+    name: Deploy
+    runs-on: ubuntu-latest
+
+    env:
+      DATABASE_URL: ${{ secrets.DATABASE_URL }}
+
+    steps:
+      - name: Check out code
+        uses: actions/checkout@v4
+
+      - name: Install goose
+        run: |
+          curl -fsSL https://raw.githubusercontent.com/pressly/goose/master/install.sh | sh
+
+      - id: 'auth'
+        uses: 'google-github-actions/auth@v2'
+        with:
+          credentials_json: '${{ secrets.GCP_CREDENTIALS }}'
+
+      - name: 'Set up Cloud SDK'
+        uses: 'google-github-actions/setup-gcloud@v3'
+
+      - name: Configure gcloud defaults
+        run: |
+          gcloud config set project notely-473217
+          gcloud config set run/region us-central1
+
+      - name: Set IMAGE_TAG
+        run: |
+          SHORT_SHA="$(echo ${{github.sha}} | head -c 8)"
+          echo "IMAGE_TAG=$SHORT_SHA" >> "$GITHUB_ENV"
+
+      - name: Build and push image (Cloud Build)
+        run: |
+          gcloud builds submit \
+            --tag us-central1-docker.pkg.dev/notely-473217/notely-ar-repo/notely:${IMAGE_TAG} .
+
+      - name: Debug DB URL presence
+        run: |
+          [ -n "$DATABASE_URL" ] && echo "DATABASE_URL is set" || echo "DATABASE_URL is MISSING"
+
+      - name: Run DB migrations
+        run: |
+          export PATH="$PWD/bin:$PATH"
+          chmod +x scripts/migrateup.sh
+          ./scripts/migrateup.sh
+
+      - name: Deploy to Cloud Run
+        run: |
+          gcloud run deploy notely \
+            --image us-central1-docker.pkg.dev/notely-473217/notely-ar-repo/notely:${IMAGE_TAG} \
+            --allow-unauthenticated \
+            --max-instances=4
+
+      # Optional: ensure unauthenticated access if first deploy
+      - name: Ensure public invoker (optional)
+        continue-on-error: true
+        run: |
+          gcloud run services add-iam-policy-binding notely \
+            --member="allUsers" \
+            --role="roles/run.invoker"
+
+
+

.github/workflows/ci.yml

@@ -0,0 +1,54 @@
+name: ci
+
+on:
+  pull_request:
+    branches: [main]
+  push:
+    branches: [addtests]
+
+jobs:
+  tests:
+    name: Tests
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Check out code
+        uses: actions/checkout@v4
+
+      - name: Set up Go
+        uses: actions/setup-go@v5
+        with:
+          go-version: "stable"
+
+      - name: Run tests
+        run: go test -cover ./...
+
+      - name: Install gosec 
+        run: go install github.com/securego/gosec/v2/cmd/gosec@latest
+
+      - name: Check gosec
+        run: gosec ./...
+
+  style:
+    name: Style
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Check out code
+        uses: actions/checkout@v4
+
+      - name: Set up Go
+        uses: actions/setup-go@v5
+        with:
+          go-version: "stable"
+
+      - name: Run formatting check
+        run: test -z "$(gofmt -l .)"
+
+      - name: Install staticcheck
+        run: go install honnef.co/go/tools/cmd/staticcheck@latest
+
+      - name: Run staticcheck
+        run: staticcheck ./...
+
+

Dockerfile

@@ -1,7 +1,15 @@
-FROM --platform=linux/amd64 debian:stable-slim
+# Build stage
+FROM golang:1.22 AS build
+WORKDIR /app
+COPY go.mod go.sum ./
+RUN go mod download
+COPY . .
+RUN CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build -o notely .
 
-RUN apt-get update && apt-get install -y ca-certificates
 
-ADD notely /usr/bin/notely
-
-CMD ["notely"]
+# Run stage
+FROM debian:stable-slim
+RUN apt-get update && apt-get install -y ca-certificates && rm -rf /var/lib/apt/lists/*
+COPY --from=build /app/notely /usr/bin/notely
+EXPOSE 8080
+CMD ["/usr/bin/notely"]

README.md

@@ -1,5 +1,7 @@
 # learn-cicd-starter (Notely)
 
+![Testing Badge](https://github.com/tjtreem/learn-cicd-starter/actions/workflows/ci.yml/badge.svg)
+
 This repo contains the starter code for the "Notely" application for the "Learn CICD" course on [Boot.dev](https://boot.dev).
 
 ## Local Development
@@ -21,3 +23,9 @@ go build -o notely && ./notely
 *This starts the server in non-database mode.* It will serve a simple webpage at `http://localhost:8080`.
 
 You do *not* need to set up a database or any interactivity on the webpage yet. Instructions for that will come later in the course!
+
+
+Tim Treem's version of Boot.Dev's Notely app.
+
+
+

handler_user.go

@@ -7,6 +7,7 @@ import (
 	"encoding/json"
 	"net/http"
 	"time"
+	"log"
 
 	"github.com/bootdotdev/learn-cicd-starter/internal/database"
 	"github.com/google/uuid"
@@ -37,7 +38,9 @@ func (cfg *apiConfig) handlerUsersCreate(w http.ResponseWriter, r *http.Request)
 		Name:      params.Name,
 		ApiKey:    apiKey,
 	})
+
 	if err != nil {
+		log.Printf("create user failed: %v", err)
 		respondWithError(w, http.StatusInternalServerError, "Couldn't create user", err)
 		return
 	}

internal/auth/get_api_key_test.go

@@ -0,0 +1,55 @@
+package auth
+
+import (
+	"errors"
+	"net/http"
+	"testing"
+)
+
+type testCase struct {
+	name      string
+	setHeader bool
+	headerVal string
+	wantKey   string
+	wantErr   error
+}
+
+func TestGetAPIKey(t *testing.T) {
+	cases := []testCase{
+		{name: "no header", setHeader: false, wantErr: ErrNoAuthHeaderIncluded},
+		{name: "empty header", setHeader: true, headerVal: "", wantErr: ErrNoAuthHeaderIncluded},
+		{name: "valid", setHeader: true, headerVal: "ApiKey my-secret", wantKey: "my-secret", wantErr: nil},
+		{name: "wrong prefix", setHeader: true, headerVal: "Bearer token", wantErr: errors.New("any")},
+		{name: "missing key", setHeader: true, headerVal: "ApiKey", wantErr: errors.New("any")},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			headers := http.Header{}
+			if tc.setHeader {
+				headers.Set("Authorization", tc.headerVal)
+			}
+
+			got, err := GetAPIKey(headers)
+
+			if tc.wantErr != nil {
+				// For the specific missing-header error:
+				if errors.Is(tc.wantErr, ErrNoAuthHeaderIncluded) && !errors.Is(err, ErrNoAuthHeaderIncluded) {
+					t.Fatalf("expected ErrNoAuthHeaderIncluded, got %v", err)
+				}
+				// For generic malformed cases just ensure err != nil
+				if errors.Is(tc.wantErr, ErrNoAuthHeaderIncluded) && err == nil {
+					t.Fatalf("expected error, got nil")
+				}
+				return
+			}
+
+			if err != nil {
+				t.Fatalf("unexpected error: %v", err)
+			}
+			if got != tc.wantKey {
+				t.Fatalf("want key %q, got %q", tc.wantKey, got)
+			}
+		})
+	}
+}

json.go

@@ -30,5 +30,10 @@ func respondWithJSON(w http.ResponseWriter, code int, payload interface{}) {
 		return
 	}
 	w.WriteHeader(code)
-	w.Write(dat)
+
+	n, err := w.Write(dat)
+	if err != nil {
+		log.Printf("respondWithJSON: write error after %d bytes: %v", n, err)
+		return
+	}
 }

main.go

@@ -7,6 +7,7 @@ import (
 	"log"
 	"net/http"
 	"os"
+	"time"
 
 	"github.com/go-chi/chi"
 	"github.com/go-chi/cors"
@@ -89,10 +90,12 @@ func main() {
 
 	router.Mount("/v1", v1Router)
 	srv := &http.Server{
-		Addr:    ":" + port,
-		Handler: router,
+		Addr:              ":" + port,
+		Handler:           router,
+		ReadHeaderTimeout: 1 * time.Second,
 	}
 
 	log.Printf("Serving on port: %s\n", port)
 	log.Fatal(srv.ListenAndServe())
+
 }

scripts/migrateup.sh

@@ -1,8 +1,5 @@
 #!/bin/bash
-
-if [ -f .env ]; then
-    source .env
-fi
-
-cd sql/schema
-goose turso $DATABASE_URL up
+set -euo pipefail
+cd "$(dirname "$0")/../sql/schema"
+echo "Running: goose turso <REDACTED> up"
+goose turso "$DATABASE_URL" up

static/index.html

@@ -7,7 +7,7 @@
 </head>
 
 <body class="section">
-    <h1>Notely</h1>
+    <h1>Welcome to Notely</h1>
 
     <div id="userCreationContainer" class="section">
         <input id="nameField" type="text" placeholder="Enter your name">