[github&storage] GitHub Actions to test compile things & safer DB queries.

.github/workflows/pull_request.yaml

@@ -0,0 +1,33 @@
+name: Pull Request Test
+
+on:
+  pull_request:
+    branches:
+      - main
+
+permissions:
+  contents: read
+
+jobs:
+  test:
+    name: Run Terraform Validate and Plan on PR
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Set up Go
+        uses: actions/setup-go@v5
+        with:
+          go-version: "1.23"
+          cache: false
+
+      - name: Install Dependencies
+        run: go mod tidy
+
+      - name: Build source
+        run: go build main.go
+
+      - name: Unit tests
+        run: go test -v ./...

storage/storage.go

@@ -217,39 +217,46 @@
 	return telemetry.Error(span, tx.Commit())
 }
 
-func sqlQuery(tables []string, fields []string, cond conditions, order *Order) string {
+func sqlQuery(tables []string, fields []string, cond conditions, order *Order) (string, []interface{}) {
 	where := []string{}
+	args := []string{}
 	if len(tables) > 0 {
 		for _, table := range tables[1:] {
 			where = append(where, fmt.Sprintf("%s.StravaID=%s.StravaID", tables[0], table))
 		}
 	}
 	if len(cond.WorkoutTypes) > 0 {
-		where = append(where, "(workouttype='"+strings.Join(cond.WorkoutTypes, "' or workouttype='")+"')")
+		where = append(where, "(workouttype="+strings.Repeat("? or workouttype=", len(cond.WorkoutTypes)-1)+"?)")
+		args = append(args, cond.WorkoutTypes...)
 	}
 	if len(cond.Types) > 0 {
-		where = append(where, "(type='"+strings.Join(cond.Types, "' or type='")+"')")
+		where = append(where, "(type="+strings.Repeat("? or type=", len(cond.Types)-1)+"?)")
+		args = append(args, cond.Types...)
 	}
 	if cond.Month > 0 && cond.Day > 0 {
-		where = append(where, fmt.Sprintf("(month < %d or (month=%d and day<=%d))", cond.Month, cond.Month, cond.Day))
+		where = append(where, "(month < ? or (month=? and day<=?))")
+		month := strconv.Itoa(cond.Month)
+		args = append(args, month, month, strconv.Itoa(cond.Day))
 	}
 	if len(cond.Years) > 0 {
-		yearStr := []string{}
+		where = append(where, "(year="+strings.Repeat("? or year=", len(cond.Years)-1)+"?)")
 		for _, y := range cond.Years {
-			yearStr = append(yearStr, strconv.Itoa(y))
+			args = append(args, strconv.Itoa(y))
 		}
-		where = append(where, "(year="+strings.Join(yearStr, " or year=")+")")
 	}
 	if cond.BEName != "" {
-		where = append(where, "besteffort.name='"+cond.BEName+"'")
+		where = append(where, "besteffort.name=?")
+		args = append(args, cond.BEName)
 	}
 	if cond.StravaID > 0 {
 		for _, t := range tables {
-			where = append(where, fmt.Sprintf("%s.stravaid=%d", t, cond.StravaID))
+			where = append(where, t+".stravaid=")
+			args = append(args, strconv.FormatInt(cond.StravaID, 10))
 		}
 	}
 	if cond.Name != "" {
-		where = append(where, fmt.Sprintf("summary.name LIKE '%s'", cond.Name))
+		where = append(where, "summary.name LIKE ?")
+		args = append(args, cond.Name)
 	}
 	condition := ""
 	if len(where) > 0 {
@@ -267,19 +274,23 @@
 			sorting += " limit " + strconv.FormatInt(int64(order.Limit), 10)
 		}
 	}
+	ifArgs := make([]interface{}, len(args))
+	for i, v := range args {
+		ifArgs[i] = v
+	}
 	return fmt.Sprintf(
 		"select %s from %s%s%s", strings.Join(fields, ","), strings.Join(tables, ","),
 		condition, sorting,
-	)
+	), ifArgs
 }
 
 func (sq *Sqlite3) QueryBestEffort(fields []string, name string, order *Order) (*sql.Rows, error) {
 	if sq.db == nil {
 		return nil, errors.New("database is nil")
 	}
-	query := sqlQuery([]string{"besteffort", "summary"}, fields, conditions{BEName: name}, order)
+	query, values := sqlQuery([]string{"besteffort", "summary"}, fields, conditions{BEName: name}, order)
 	// slog.Info("storage.Query", "query", query)
-	rows, err := sq.db.Query(query)
+	rows, err := sq.db.Query(query, values...)
 	if err != nil {
 		return nil, fmt.Errorf("%s failed: %w", query, err)
 	}
@@ -290,12 +301,12 @@
 	if sq.db == nil {
 		return nil, errors.New("database is nil")
 	}
-	query := sqlQuery(
+	query, values := sqlQuery(
 		[]string{"besteffort"}, []string{"distinct(name)"}, conditions{},
 		&Order{OrderBy: []string{"distance desc"}},
 	)
 	// slog.Info("storage.Query", "query", query)
-	rows, err := sq.db.Query(query)
+	rows, err := sq.db.Query(query, values...)
 	if err != nil {
 		return nil, fmt.Errorf("%s failed: %w", query, err)
 	}
@@ -316,9 +327,11 @@
 	if sq.db == nil {
 		return nil, errors.New("database is nil")
 	}
-	query := sqlQuery([]string{"split"}, fields, conditions{StravaID: id}, &Order{OrderBy: []string{"split"}})
+	query, values := sqlQuery(
+		[]string{"split"}, fields, conditions{StravaID: id}, &Order{OrderBy: []string{"split"}},
+	)
 	// slog.Info("storage.Query", "query", query)
-	rows, err := sq.db.Query(query)
+	rows, err := sq.db.Query(query, values...)
 	if err != nil {
 		return nil, fmt.Errorf("%s failed: %w", query, err)
 	}
@@ -329,7 +342,7 @@
 	if sq.db == nil {
 		return nil, errors.New("database is nil")
 	}
-	query := sqlQuery(
+	query, values := sqlQuery(
 		[]string{"summary"}, fields,
 		conditions{
 			Types: cond.Types, WorkoutTypes: cond.WorkoutTypes,
@@ -339,7 +352,7 @@
 		order,
 	)
 	// slog.Info("storage.Query", "query", query)
-	rows, err := sq.db.Query(query)
+	rows, err := sq.db.Query(query, values...)
 	if err != nil {
 		return nil, fmt.Errorf("%s failed: %w", query, err)
 	}

storage/storage_test.go

@@ -1,6 +1,10 @@
 package storage
 
-import "testing"
+import (
+	"fmt"
+	"strings"
+	"testing"
+)
 
 func TestSqlQuery(t *testing.T) {
 	values := []struct {
@@ -10,53 +14,60 @@ func TestSqlQuery(t *testing.T) {
 		cond   conditions
 		order  *Order
 		query  string
+		values []string
 	}{
 		{
 			"none", []string{"summary"}, []string{"field"}, conditions{}, nil,
-			"select field from summary"},
+			"select field from summary", []string{},
+		},
 		{
 			"simple", []string{"summary"}, []string{"field"}, conditions{Types: []string{"Run"}}, nil,
-			"select field from summary where (type='Run')",
+			"select field from summary where (type=?)", []string{"Run"},
 		},
 		{
 			"multi-field", []string{"summary"}, []string{"f1", "f2"},
 			conditions{Types: []string{"r1", "r2"}},
 			&Order{GroupBy: []string{"f3"}, OrderBy: []string{"f3 desc"}},
-			"select f1,f2 from summary where (type='r1' or type='r2') group by f3 order by f3 desc",
+			"select f1,f2 from summary where (type=? or type=?) group by f3 order by f3 desc", []string{"r1", "r2"},
 		},
 		{
 			"order", []string{"summary"}, []string{"k1", "k2"},
 			conditions{Types: []string{"c1"}, WorkoutTypes: []string{"c3"}},
 			&Order{GroupBy: []string{"k3", "k4"}, OrderBy: []string{"k5", "k6"}, Limit: 7},
-			"select k1,k2 from summary where (workouttype='c3') and (type='c1') group by k3,k4 order by k5,k6 limit 7",
+			"select k1,k2 from summary where (workouttype=?) and (type=?) group by k3,k4 order by k5,k6 limit 7",
+			[]string{"c3", "c1"},
 		},
 		{
 			"one_year", []string{"summary"}, []string{"field"},
 			conditions{Types: []string{"Run"}, Years: []int{2023}}, nil,
-			"select field from summary where (type='Run') and (year=2023)",
+			"select field from summary where (type=?) and (year=?)", []string{"Run", "2023"},
 		},
 		{
 			"multiple_years", []string{"summary"}, []string{"field"},
 			conditions{Types: []string{"Run"}, Years: []int{2019, 2023}}, nil,
-			"select field from summary where (type='Run') and (year=2019 or year=2023)",
+			"select field from summary where (type=?) and (year=? or year=?)", []string{"Run", "2019", "2023"},
 		},
 		{
 			"ids", []string{"summary"},
 			[]string{"StravaID"},
 			conditions{Types: []string{"Run"}},
 			&Order{OrderBy: []string{"StravaID desc"}},
-			"select StravaID from summary where (type='Run') order by StravaID desc",
+			"select StravaID from summary where (type=?) order by StravaID desc", []string{"Run"},
 		},
 		{
 			"besteffort", []string{"summary", "besteffort"}, []string{"summary.Name"}, conditions{BEName: "400m"}, nil,
-			"select summary.Name from summary,besteffort where summary.StravaID=besteffort.StravaID and besteffort.name='400m'",
+			"select summary.Name from summary,besteffort where summary.StravaID=besteffort.StravaID and besteffort.name=?",
+			[]string{"400m"},
 		},
 	}
 	for _, value := range values {
 		t.Run(value.name, func(t *testing.T) {
-			cmd := sqlQuery(value.tables, value.fields, value.cond, value.order)
+			cmd, values := sqlQuery(value.tables, value.fields, value.cond, value.order)
 			if cmd != value.query {
-				t.Errorf("mismatch got '%s' vs. expected '%s'", cmd, value.query)
+				t.Errorf("query mismatch got '%s' vs. expected '%s'", cmd, value.query)
+			}
+			if fmt.Sprintf("%v", values) != "["+strings.Join(value.values, " ")+"]" {
+				t.Errorf("values mismatch got '%s' vs. expected '%s'", fmt.Sprintf("%v", values), strings.Join(value.values, " "))
 			}
 		})
 	}