Conversation
- Added a new E2E_TESTING.md file detailing the E2E testing framework, coverage, and local execution instructions. - Expanded CI workflow to include a dedicated E2E test job that validates API endpoints against the OpenAPI specification using Schemathesis. - Updated README.md to clarify test sections and introduce End-to-End (E2E) testing.
- Replaced all instances of 'docker-compose' with 'docker compose' in the CI workflow and E2E_TESTING.md to align with Docker Compose V2 syntax. - Updated documentation to specify the requirement for Docker with Compose V2 installed.
- Changed the volume mapping for spaceapi.json from /root/spaceapi.json to /app/spaceapi.json to align with application structure.
…tion - Changed '--base-url' to '--url' in the CI workflow and E2E_TESTING.md to align with the latest Schemathesis syntax for running OpenAPI conformance tests.
…tation - Removed '--hypothesis-phases=explicit' and '--report' options from Schemathesis commands in both the CI workflow and E2E_TESTING.md to streamline testing configurations and align with best practices.
…nds in CI workflow and documentation - Eliminated the '--show-errors-tracebacks' option from Schemathesis commands in both the CI workflow and E2E_TESTING.md to simplify command usage and improve clarity.
- Changed the `value` property in `openapi.yaml` from `oneOf` to `anyOf` to allow for more flexible data types. - Updated CI workflow and documentation to exclude `negative_data_rejection` checks from Schemathesis tests, clarifying the rationale for these exclusions in `E2E_TESTING.md`.
…zing hypothesis phases - Added `--hypothesis-phases explicit,fuzzing` to Schemathesis commands in the CI workflow to enhance testing focus. - Updated `E2E_TESTING.md` to clarify the rationale for excluding `negative_data_rejection` checks and the benefits of the new hypothesis phases, emphasizing real-world API functionality and schema validation.
- Updated Schemathesis commands in the CI workflow to focus on specific validation checks: `status_code_conformance`, `content_type_conformance`, `response_schema_conformance`, and `response_headers_conformance`. - Revised `E2E_TESTING.md` to reflect the new focus on practical API conformance, detailing enabled and excluded checks for clarity and improved testing relevance.
- Updated Schemathesis commands in the CI workflow and E2E_TESTING.md to use a consistent comma-separated format for the `--checks` option, enhancing clarity and reducing potential errors in command execution.
…tation - Updated the CI workflow to include detailed checks for data persistence, verifying `state.open`, `state.message`, `sensors.people_now[0].value`, and `state.lastchange` after POST operations. - Expanded E2E_TESTING.md to document the new data persistence verification steps, ensuring clarity on the expected outcomes and structure of the API response.
- Modified the CI workflow to check the updated people count using `sensors.people_now_present` instead of `sensors.people_now`, ensuring accurate data validation. - Updated E2E_TESTING.md to reflect the change in the verification method for the people count, enhancing clarity on the expected API response structure.
Raise the Go version everywhere the toolchain is pinned to clear the stdlib security advisories flagged against the 1.21/1.22 toolchain: - go.mod: go 1.21 -> 1.26.0 - Dockerfile.spaceapi: golang:1.21-alpine -> golang:1.26-alpine (the shipped release artifact) - ci.yml / release.yml: setup-go go-version '1.22' -> '1.26' Verified locally on go1.26.4: go vet clean, go build and full test suite pass.
Move github-context values out of run: script bodies and into env:, referencing them as quoted shell variables, per the GitHub Actions injection guidance. Also quote parameter expansions and $GITHUB_OUTPUT. - Determine version: github.event_name, github.event.inputs.version - Update package visibility: github.repository Pre-existing issues surfaced while bumping the Go version; fixed separately to keep the toolchain bump self-contained.
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
The pinned golangci-lint v1.64.8 (built with Go 1.24) refuses to lint a module whose go.mod targets a newer Go than itself, breaking the Lint job after the 1.26 bump. Upgrade to golangci-lint-action v9 + v2, which is built with Go 1.26 and natively supports the directive. - ci.yml: golangci-lint-action v6 -> v9, drop obsolete --timeout arg (v2 disables the timeout by default) - .golangci.yml: add minimal v2 config (version: "2", default linters)
Reconcile divergence before the Go 1.26 toolchain PR. Both branches independently added the e2e-test job to ci.yml; resolved by keeping main's least-privilege `permissions: contents: read` block. Brings in main's CODE_OF_CONDUCT.md and SECURITY.md.
golangci-lint v2 (now able to analyze the module) flags the redundant type in `var ip_address string = r.RemoteAddr`. Use an idiomatic short declaration and camelCase name. Behavior-preserving.
testify is used directly in the handler/middleware tests but was recorded as `// indirect`. `go mod tidy` moves it into a direct require block and completes go.sum. No functional change.
| var ip_address string = r.RemoteAddr | ||
| log.Printf("%s State updated: %+v from %s", time.Unix(h.spaceAPI.State.Lastchange, 0).Format(time.RFC3339), h.spaceAPI.State, ip_address) | ||
| ipAddress := r.RemoteAddr | ||
| log.Printf("%s State updated: %+v from %s", time.Unix(h.spaceAPI.State.Lastchange, 0).Format(time.RFC3339), h.spaceAPI.State, ipAddress) |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Bumps the Go toolchain to 1.26 everywhere it is pinned, clearing the 51 stdlib security advisories flagged against the previous 1.21/1.22 toolchain, and hardens the release workflow against shell injection.
Changes
Go toolchain bump (
dcdbb89)go.mod:go 1.21→go 1.26.0Dockerfile.spaceapi:golang:1.21-alpine→golang:1.26-alpine(the shipped release artifact)ci.yml/release.yml:setup-gogo-version'1.22'→'1.26'Release workflow hardening (
b9fb25d)github-context values out ofrun:bodies intoenv:, referenced as quoted shell variables (per the GitHub Actions injection guidance)$GITHUB_OUTPUTVerification
Local, on
go1.26.4:go vet ./...— cleango build ./cmd/spaceapi— OKgo test ./internal/... ./cmd/...— passingNotes
v0.1.2tag will be cut immediately after this merges (resets the release-cadence clock).