chore: update Go version to 1.23 and improve security#5
Conversation
- Update Dockerfile to use golang:1.23-alpine - Replace hardcoded credentials with template variables in Postman collection - Remove unused imports from holiday handler tests - Remove generate_password_hash.go utility script
ilramdhan
added
bug
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
Code Review SummaryStatus: No Issues Found | Recommendation: Merge Files Reviewed (4 files)
SummaryThis PR contains clean improvements:
The repository uses Go (Golang) as its primary programming language. All changes follow best practices for this language. |
There was a problem hiding this comment.
Pull request overview
Updates the build/runtime tooling and developer collateral to move the project to Go 1.23 and reduce accidental credential exposure in shared artifacts.
Changes:
- Bumps the Docker build stage to
golang:1.23-alpine. - Replaces hardcoded credentials in the Postman collection with template variables.
- Removes unused test imports and deletes a password-hash generator utility script.
Reviewed changes
Copilot reviewed 4 out of 4 changed files in this pull request and generated 4 comments.
| File | Description |
|---|---|
| Dockerfile | Updates builder image to Go 1.23 for container builds. |
| docs/HolidayAPI.postman_collection.json | Removes hardcoded credentials by switching request bodies to Postman variables. |
| internal/handlers/holiday_handler_test.go | Cleans up unused imports in handler tests. |
| scripts/generate_password_hash.go | Removes a local utility that included a hardcoded password. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| "mode": "raw", | ||
| "raw": "{\n \"old_password\": \"Admin123!\",\n \"new_password\": \"NewPassword123!\"\n}" | ||
| "raw": "{\n \"old_password\": \"{{old_password}}\",\n \"new_password\": \"{{new_password}}\"\n}" | ||
| }, |
There was a problem hiding this comment.
The change-password body now references {{old_password}} / {{new_password}}, but these variables are not defined in the collection’s variable section. Add them as collection variables (empty/default) or note that they must come from a Postman environment to avoid sending blank passwords.
| @@ -1,5 +1,5 @@ | |||
| # Build stage | |||
| FROM golang:1.21-alpine AS builder | |||
| FROM golang:1.23-alpine AS builder | |||
There was a problem hiding this comment.
Consider pinning the Go builder image to a specific patch/alpine variant (e.g., golang:1.23.x-alpine3.y) instead of a floating 1.23-alpine tag. Floating tags can change underneath you and make builds non-reproducible, and can also introduce unexpected CVEs or behavior changes between builds.
| FROM golang:1.23-alpine AS builder | |
| FROM golang:1.23.0-alpine3.19 AS builder |
| @@ -1,5 +1,5 @@ | |||
| # Build stage | |||
| FROM golang:1.21-alpine AS builder | |||
| FROM golang:1.23-alpine AS builder | |||
There was a problem hiding this comment.
Dockerfile now builds with golang:1.23-alpine, but the repository go.mod specifies a toolchain directive (go1.24.5). With a 1.23 builder image, go may try to auto-download the toolchain during go build, which can break reproducible/offline builds and slow CI. Consider aligning the builder image tag with the toolchain version (or removing/adjusting the toolchain directive) so the container build uses the intended Go toolchain without network downloads.
| FROM golang:1.23-alpine AS builder | |
| FROM golang:1.24-alpine AS builder |
| "mode": "raw", | ||
| "raw": "{\n \"username\": \"admin\",\n \"password\": \"Admin123!\"\n}" | ||
| "raw": "{\n \"username\": \"{{username}}\",\n \"password\": \"{{password}}\"\n}" | ||
| }, |
There was a problem hiding this comment.
The collection request body now references {{username}} / {{password}}, but these variables are not defined in the collection-level variable list (only base_url, access_token, and refresh_token are). Add username and password as collection variables (with empty/default values and a description) or document that they must be provided via a Postman environment, otherwise the login request will send empty values.
Description
This PR updates the Go version to 1.23, improves security by replacing hardcoded credentials with template variables in the Postman collection, removes unused imports from tests, and cleans up by removing the password hash generator script.
Fixes # (issue number)
Type of Change
Changes Made
How Has This Been Tested?
Test Configuration:
Checklist
Screenshots (if applicable)
Additional Notes
The Postman collection changes improve security by avoiding hardcoded credentials in the API documentation. The Dockerfile update ensures the project uses the latest stable Go version.
Related PRs