feat: add Go worker tests and include in CI

- Add webhook tests: HMAC signing, headers, status handling, timeout
- Add writer tests: credential stripping, truncation, edge cases
- Add Go test step to CI workflow (actions/setup-go + go test)

1 files changed, 67 insertions, 0 deletions

diff --git a/services/worker/internal/writer/writer_test.go b/services/worker/internal/writer/writer_test.go
new file mode 100644
index 0000000..37aac83
--- /dev/null
+++ b/services/worker/internal/writer/writer_test.go
@@ -0,0 +1,67 @@
+package writer
+
+import (
+	"github.com/stretchr/testify/assert"
+	"strings"
+	"testing"
+)
+
+func TestSanitizeErrorMessageStripsCredentials(test *testing.T) {
+	errorMessage := "failed to fetch https://user:[email protected]/feed.xml: connection refused"
+	sanitized := sanitizeErrorMessage(errorMessage)
+
+	assert.NotContains(test, sanitized, "user:password")
+	assert.Contains(test, sanitized, "example.com")
+	assert.Contains(test, sanitized, "connection refused")
+}
+
+func TestSanitizeErrorMessageTruncatesLongMessages(test *testing.T) {
+	longMessage := strings.Repeat("a", 1000)
+	sanitized := sanitizeErrorMessage(longMessage)
+
+	assert.Len(test, sanitized, 500)
+}
+
+func TestSanitizeErrorMessagePreservesShortMessages(test *testing.T) {
+	shortMessage := "simple error"
+	sanitized := sanitizeErrorMessage(shortMessage)
+
+	assert.Equal(test, "simple error", sanitized)
+}
+
+func TestSanitizeErrorMessageNoURLs(test *testing.T) {
+	errorMessage := "connection timed out after 30 seconds"
+	sanitized := sanitizeErrorMessage(errorMessage)
+
+	assert.Equal(test, "connection timed out after 30 seconds", sanitized)
+}
+
+func TestSanitizeErrorMessageURLWithoutCredentials(test *testing.T) {
+	errorMessage := "failed to fetch https://example.com/feed.xml: 404"
+	sanitized := sanitizeErrorMessage(errorMessage)
+
+	assert.Equal(test, errorMessage, sanitized)
+}
+
+func TestSanitizeErrorMessageMultipleURLsWithCredentials(test *testing.T) {
+	errorMessage := "redirect from https://admin:[email protected] to https://user:[email protected]"
+	sanitized := sanitizeErrorMessage(errorMessage)
+
+	assert.NotContains(test, sanitized, "admin:secret")
+	assert.NotContains(test, sanitized, "user:pass")
+	assert.Contains(test, sanitized, "old.example.com")
+	assert.Contains(test, sanitized, "new.example.com")
+}
+
+func TestSanitizeErrorMessageExactly500Characters(test *testing.T) {
+	exactMessage := strings.Repeat("b", 500)
+	sanitized := sanitizeErrorMessage(exactMessage)
+
+	assert.Len(test, sanitized, 500)
+}
+
+func TestSanitizeErrorMessageEmptyString(test *testing.T) {
+	sanitized := sanitizeErrorMessage("")
+
+	assert.Equal(test, "", sanitized)
+}