diff --git a/.github/workflows/go-coverage.yml b/.github/workflows/go-coverage.yml
new file mode 100644
index 000000000..03a3e81ff
--- /dev/null
+++ b/.github/workflows/go-coverage.yml
@@ -0,0 +1,46 @@
+name: Go Baseline Coverage
+
+on:
+  push:
+    paths:
+      - 'workspaces/backend/**'
+    branches:
+      - notebook-v2
+
+permissions:
+  contents: write
+
+jobs:
+  test:
+    name: Run Tests and Generate Coverage
+    runs-on: ubuntu-latest
+
+    defaults:
+      run:
+        working-directory: workspaces/backend  # 👈 where your go.mod is
+
+    steps:
+      - name: Checkout Code
+        uses: actions/checkout@v3
+
+      - name: Set up Go
+        uses: actions/setup-go@v5
+        with:
+          go-version-file: workspaces/backend/go.mod
+          check-latest: true
+          cache-dependency-path: workspaces/backend/go.sum
+
+      - name: Download Dependencies
+        run: go mod download
+
+      - name: Run Tests with Coverage
+        run: |
+          go test ./api/... -coverprofile=coverage.baseline
+
+      - name: Commit backend coverage file
+        run: |
+          git config --global user.name 'GitHub Actions'
+          git config --global user.email 'github-actions@github.com'
+          git add coverage.baseline
+          git commit -m "Update coverage baseline" || echo "No changes to commit"
+          git push origin HEAD:notebook-v2
diff --git a/workspaces/backend/.gitignore b/workspaces/backend/.gitignore
index ce6feea73..e93bdceb1 100644
--- a/workspaces/backend/.gitignore
+++ b/workspaces/backend/.gitignore
@@ -4,7 +4,7 @@
 *.dll
 *.so
 *.dylib
-bin/*
+bin/**/*
 Dockerfile.cross
 
 # Test binary, built with `go test -c`
diff --git a/workspaces/backend/api/workspaces_handler.go b/workspaces/backend/api/workspaces_handler.go
index a64c04c70..10e93ce75 100644
--- a/workspaces/backend/api/workspaces_handler.go
+++ b/workspaces/backend/api/workspaces_handler.go
@@ -81,6 +81,7 @@ func (a *App) GetWorkspaceHandler(w http.ResponseWriter, r *http.Request, ps htt
 			},
 		),
 	}
+
 	if success := a.requireAuth(w, r, authPolicies); !success {
 		return
 	}