Address review feedback

Author: cbrown132

internal/api/api.go

@@ -240,7 +240,10 @@ func (s *Server) handleScanRepo(w http.ResponseWriter, r *http.Request) {
 
 	var req scanRequest
 	if r.Body != nil {
-		json.NewDecoder(r.Body).Decode(&req)
+		if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
+			http.Error(w, "Invalid JSON body", http.StatusBadRequest)
+			return
+		}
 	}
 	if req.Trigger == "" {
 		req.Trigger = "manual"
@@ -334,7 +337,10 @@ func (s *Server) handleScanStack(w http.ResponseWriter, r *http.Request) {
 
 	var req scanRequest
 	if r.Body != nil {
-		json.NewDecoder(r.Body).Decode(&req)
+		if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
+			http.Error(w, "Invalid JSON body", http.StatusBadRequest)
+			return
+		}
 	}
 	if req.Trigger == "" {
 		req.Trigger = "manual"

internal/queue/task.go

@@ -5,6 +5,8 @@ import (
 	"encoding/json"
 	"errors"
 	"fmt"
+	"os"
+	"path/filepath"
 	"strconv"
 	"time"
 
@@ -319,26 +321,33 @@ func (q *Queue) MarkTaskEnqueueFailed(ctx context.Context, taskID string) error
 
 func (q *Queue) maybeFinishTask(ctx context.Context, taskID string) error {
 	taskKey := keyTaskPrefix + taskID
-	values, err := q.client.HMGet(ctx, taskKey, "repo", "total", "completed", "failed").Result()
+	values, err := q.client.HMGet(ctx, taskKey, "repo", "total", "completed", "failed", "workspace").Result()
 	if err != nil {
 		return err
 	}
-	if len(values) != 4 {
+	if len(values) != 5 {
 		return nil
 	}
 
 	repoName, _ := values[0].(string)
 	total := toInt(values[1])
 	completed := toInt(values[2])
 	failed := toInt(values[3])
+	workspacePath, _ := values[4].(string)
 
 	if total == 0 {
 		return q.finishTask(ctx, taskKey, repoName, 0)
 	}
 	if completed+failed < total {
 		return nil
 	}
-	return q.finishTask(ctx, taskKey, repoName, failed)
+	if err := q.finishTask(ctx, taskKey, repoName, failed); err != nil {
+		return err
+	}
+	if workspacePath != "" {
+		_ = os.RemoveAll(filepath.Dir(workspacePath))
+	}
+	return nil
 }
 
 func (q *Queue) finishTask(ctx context.Context, taskKey, repoName string, failed int) error {

internal/runner/runner.go

@@ -140,7 +140,7 @@ func detectTool(stackPath string) string {
 
 func runPlan(ctx context.Context, workDir, tool, tfBin, tgBin, repoRoot, stackPath string) (string, error) {
 	var output bytes.Buffer
-	dataDir := filepath.Join(os.TempDir(), "driftd-tfdata", safePath(stackPath))
+	dataDir := filepath.Join(os.TempDir(), "driftd-tfdata", safePath(stackPath), filepath.Base(repoRoot))
 	if err := os.MkdirAll(dataDir, 0755); err == nil {
 		defer os.RemoveAll(dataDir)
 	}

internal/scheduler/scheduler.go

@@ -85,9 +85,10 @@ func (s *Scheduler) enqueueRepoScans(repoName, repoURL string) {
 				log.Printf("Skipping scheduled scan for %s: repo already running", repoName)
 				return
 			}
+		} else {
+			log.Printf("Failed to start task for %s: %v", repoName, err)
+			return
 		}
-		log.Printf("Failed to start task for %s: %v", repoName, err)
-		return
 	}
 	go s.queue.RenewTaskLock(context.Background(), task.ID, repoName, s.cfg.Worker.TaskMaxAge, s.cfg.Worker.RenewEvery)
 

internal/worker/worker.go

@@ -132,15 +132,17 @@ func (w *Worker) processJob(job *queue.Job) {
 
 	if w.cfg != nil {
 		if repoCfg := w.cfg.GetRepo(job.RepoName); repoCfg != nil {
-			authMethod, authErr := gitauth.AuthMethod(ctx, repoCfg)
-			if authErr != nil {
-				log.Printf("Job %s failed (git auth): %v", job.ID, authErr)
-				if failErr := w.queue.Fail(w.ctx, job, authErr.Error()); failErr != nil {
-					log.Printf("Failed to mark job %s as failed: %v", job.ID, failErr)
+			if workspacePath == "" {
+				authMethod, authErr := gitauth.AuthMethod(ctx, repoCfg)
+				if authErr != nil {
+					log.Printf("Job %s failed (git auth): %v", job.ID, authErr)
+					if failErr := w.queue.Fail(w.ctx, job, authErr.Error()); failErr != nil {
+						log.Printf("Failed to mark job %s as failed: %v", job.ID, failErr)
+					}
+					return
 				}
-				return
+				auth = authMethod
 			}
-			auth = authMethod
 		}
 	}