How inwerejosic/go-for-trivy-test works
Purpose and Entry Point
This is a minimal Go/Gin HTTP API used to demonstrate REST handling, container delivery, and CI security validation. The process entry point is main.go; it starts a Gin server intended to listen on port 8080.
HTTP API Layer
Gin owns request routing, JSON binding, and response serialization in main.go.
• GET /ping is the health/check endpoint and returns a static JSON message.
• POST /greet accepts a JSON body containing name and returns a greeting.
• The API is stateless: no database, queue, filesystem persistence, authentication, or external application service is indicated.
Paths: main.go, go.mod
Greeting Decision Flow
The /greet request crosses a small in-process flow in main.go:
1. Gin decodes the request JSON into the request model.
2. Server-local current time determines the greeting period (morning, afternoon, evening, or night).
3. The selected greeting and supplied name are serialized as JSON.
The server clock is the material boundary for greeting behavior; output can vary by runtime time zone and hour.
Paths: main.go
Go Dependency Boundary
The application is a Go module, with Gin as its principal web-framework dependency. Dependency versions and transitive dependency integrity are captured by the module manifests.
Paths: go.mod, go.sum
Container Runtime
Dockerfile packages the Go API as a Docker image. The image is run with port 8080 exposed/mapped to the host, making the Gin listener reachable externally. Docker is the intended local and CI runtime boundary rather than a separate application platform.
Paths: Dockerfile, main.go
CI Build, Runtime Verification, and Security Gate
GitHub Actions executes the delivery validation pipeline. It builds the Docker image, runs the container, exercises the API endpoints, and scans the built image with Trivy. HIGH or CRITICAL vulnerability findings are a release-quality gate that fails CI.
The workflow is triggered for changes targeting main according to repository documentation.
Paths: .github/workflows/docker-build.yaml, Dockerfile
External Infrastructure and Services
• GitHub Actions provides hosted CI execution.
• Docker provides image build and container execution.
• Trivy provides image vulnerability scanning against known-vulnerability data.
• No deployed cloud service, registry publishing, database, secret store, or observability backend is represented in the repository tree.
Main entry points: Dockerfile Running API container · docker-build.yaml GitHub Actions · main.go Gin router · go.mod Go module + Gin
Components 13
Go API
- Gin router · Routes requests and handles JSON binding and responses.
main.go - GET /ping · Returns a static JSON message.
main.go - POST /greet
main.go - Greeting request · Accepts the supplied name.
main.go - Server clock · Current hour and time zone select the greeting period.
main.go - Greeting JSON · Returns the selected greeting and name.
main.go - Go module + Gin · Defines Gin and dependency integrity.
go.mod
Container Delivery
- Docker image build · Packages the Go API for port 8080.
Dockerfile - Running API container · Exposes the Gin listener on port 8080.
Dockerfile
CI Validation
- GitHub Actions · Runs validation for changes targeting main.
.github/workflows/docker-build.yaml - Endpoint verification · Exercises the running container API endpoints.
.github/workflows/docker-build.yaml - Trivy image scan · HIGH or CRITICAL findings fail CI.
.github/workflows/docker-build.yaml
Other components
- API client
Connections 16
- API client → Running API container: port 8080
- Running API container → Gin router: serves
- Gin router → GET /ping: GET /ping
- Gin router → POST /greet: POST /greet
- POST /greet → Greeting request: binds JSON
- POST /greet → Server clock: reads current time
- Server clock → Greeting JSON: selects period
- Greeting request → Greeting JSON: supplies name
- Go module + Gin → Gin router: provides framework
- Docker image build → Running API container: builds image
- GitHub Actions → Docker image build: builds
- GitHub Actions → Running API container: runs
- GitHub Actions → Endpoint verification: executes
- Endpoint verification → Running API container: calls endpoints
- GitHub Actions → Trivy image scan: scans image
- Trivy image scan → Docker image build: gates image