Skip to content

chore: update Go version to 1.23 and improve security #5

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
ilramdhan merged 1 commit into from
Mar 4, 2026
Merged

chore: update Go version to 1.23 and improve security #5

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
# Build stage
FROM golang:1.21-alpine AS builder
FROM golang:1.23-alpine AS builder
Copy link

Copilot AI Mar 4, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Consider pinning the Go builder image to a specific patch/alpine variant (e.g., golang:1.23.x-alpine3.y) instead of a floating 1.23-alpine tag. Floating tags can change underneath you and make builds non-reproducible, and can also introduce unexpected CVEs or behavior changes between builds.

Suggested change
FROM golang:1.23-alpine AS builder
FROM golang:1.23.0-alpine3.19 AS builder

Copilot uses AI. Check for mistakes.
Copy link

Copilot AI Mar 4, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Dockerfile now builds with golang:1.23-alpine, but the repository go.mod specifies a toolchain directive (go1.24.5). With a 1.23 builder image, go may try to auto-download the toolchain during go build, which can break reproducible/offline builds and slow CI. Consider aligning the builder image tag with the toolchain version (or removing/adjusting the toolchain directive) so the container build uses the intended Go toolchain without network downloads.

Suggested change
FROM golang:1.23-alpine AS builder
FROM golang:1.24-alpine AS builder

Copilot uses AI. Check for mistakes.

# Install build dependencies
RUN apk add --no-cache git gcc musl-dev sqlite-dev
Expand Down
4 changes: 2 additions & 2 deletions docs/HolidayAPI.postman_collection.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -210,7 +210,7 @@
],
"body": {
"mode": "raw",
"raw": "{\n \"username\": \"admin\",\n \"password\": \"Admin123!\"\n}"
"raw": "{\n \"username\": \"{{username}}\",\n \"password\": \"{{password}}\"\n}"
},
Comment on lines 212 to 214
Copy link

Copilot AI Mar 4, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The collection request body now references {{username}} / {{password}}, but these variables are not defined in the collection-level variable list (only base_url, access_token, and refresh_token are). Add username and password as collection variables (with empty/default values and a description) or document that they must be provided via a Postman environment, otherwise the login request will send empty values.

Copilot uses AI. Check for mistakes.
"url": {
"raw": "{{base_url}}/api/v1/auth/login",
Expand Down Expand Up @@ -279,7 +279,7 @@
],
"body": {
"mode": "raw",
"raw": "{\n \"old_password\": \"Admin123!\",\n \"new_password\": \"NewPassword123!\"\n}"
"raw": "{\n \"old_password\": \"{{old_password}}\",\n \"new_password\": \"{{new_password}}\"\n}"
},
Comment on lines 281 to 283
Copy link

Copilot AI Mar 4, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The change-password body now references {{old_password}} / {{new_password}}, but these variables are not defined in the collection’s variable section. Add them as collection variables (empty/default) or note that they must come from a Postman environment to avoid sending blank passwords.

Copilot uses AI. Check for mistakes.
"url": {
"raw": "{{base_url}}/api/v1/auth/change-password",
Expand Down
2 changes: 0 additions & 2 deletions internal/handlers/holiday_handler_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,6 @@
package handlers

import (
"bytes"
"encoding/json"
"net/http"
"net/http/httptest"
Expand All @@ -13,7 +12,6 @@ import (
"github.com/stretchr/testify/mock"

"github.com/ilramdhan/holidayapi/internal/models"
"github.com/ilramdhan/holidayapi/internal/services"
)

// MockHolidayService is a mock implementation of HolidayService
Expand Down
29 changes: 0 additions & 29 deletions scripts/generate_password_hash.go
View file
Open in desktop

This file was deleted.

Loading