Copilot Review Comments

PR #7815 (fix: Go backend batch 2 — error handling, validation, constants, race fixes) was merged with 9 Copilot review comment(s) that should be addressed in a follow-up:

• pkg/api/handlers/user.go:58: New behavior returns 400 for emails missing '@', but user handler tests don’t cover this validation path. Add a unit test asserting UpdateCurrentUser rejects an invalid email (and does not call Upda...
• pkg/api/handlers/events.go:47: New behavior returns 400 for invalid card_id UUIDs, but the existing events handler tests don’t cover this negative case. Add a test that posts an invalid card_id and asserts a 400 response (and t...
• entrypoint.sh:1: Switching the shebang to #!/bin/bash will break the published container image: the runtime stage in Dockerfile is Alpine and does not install bash, so the entrypoint will fail with “/bin/bash: not f...
• pkg/api/handlers/gitops.go:756: singleflight.Do runs the fetch using the first caller’s ctx. If that request context is canceled (client disconnect/timeout), it can abort the shared fetch and cause other concurrent callers (with...
• pkg/api/handlers/orbit.go:156: Orbit mission IDs now include a millisecond timestamp plus generateOrbitSuffix(), but there’s no test ensuring the ID is auto-generated when missing and includes the expected suffix/format. Adding a...
• pkg/api/handlers/orbit.go:26: The crypto/rand failure fallback is broken: time.Now().Format("0000") returns the literal string "0000" (Go’s time.Format uses a reference layout), so the suffix becomes non-random and can reintrodu...
• pkg/api/handlers/gitops.go:837: Same singleflight/context issue here: the coalesced fetch uses the first caller’s ctx, so cancellation/timeout in one request can cancel the shared fetch for other concurrent callers. Detach cancell...
• pkg/api/handlers/crds.go:83: This branch returns fiber.StatusServiceUnavailable directly instead of using the file-level statusServiceUnavailableCRD constant that’s already defined and used above. Using the constant here too ...
• pkg/api/handlers/admission_webhooks.go:80: This branch returns fiber.StatusServiceUnavailable directly instead of using the file-level statusServiceUnavailableWebhook constant defined just above. Consider using the constant here as well to...

PR: #7815

Auto-generated by copilot-comment-followup workflow