chore(release): prepare for v0.5.1 (#324)

## [0.5.1] - 2026-08-21

### 🐛 Bug Fixes

- *(ci)* Use go-test-coverage binary directly to fix Gitea Actions (#303)
- *(deps)* Update module github.com/stretchr/testify to v1.12.0 (#319)
- *(deps)* Update module github.com/stretchr/testify to v1.12.1 (#321)

### ⚙️ Miscellaneous Tasks

- *(deps)* Update pre-commit hook gitleaks/gitleaks to v8.30.1 (#296)
- *(deps)* Update pre-commit hook golangci/golangci-lint to v2.11.4 (#298)
- *(deps)* Update dependency go to v1.26.2 (#300)
- *(deps)* Update pre-commit hook alessandrojcm/commitlint-pre-commit-hook to v9.25.0 (#304)
- *(deps)* Update pre-commit hook golangci/golangci-lint to v2.12.0 (#306)
- *(deps)* Update pre-commit hook golangci/golangci-lint to v2.12.1 (#308)
- *(deps)* Update pre-commit hook golangci/golangci-lint to v2.12.2 (#309)
- *(deps)* Update actions/checkout action to v7 (#311)
- *(deps)* Update pre-commit hook alessandrojcm/commitlint-pre-commit-hook to v9.26.0 (#313)
- *(deps)* Update actions/setup-go action to v7 (#315)
- *(deps)* Update actions/setup-python action to v7 (#317)
- *(deps)* Update pre-commit hook golangci/golangci-lint to v2.13.1 (#322)

<!-- generated by git-cliff -->

---

**Note:** Please use **Squash Merge** when merging this PR.

Reviewed-on: #324
Co-authored-by: Unbound Releaser <releaser@unbound.se>

.gitea/workflows/ci.yaml

@@ -10,19 +10,18 @@ jobs:
   test:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
-      - uses: actions/setup-go@v6
+      - uses: actions/setup-go@v7
         with:
           go-version: 'stable'
       - name: Run tests
         run: go test -race -coverprofile=coverage.txt ./...
 
       - name: Check coverage
-        uses: vladopajic/go-test-coverage@v2
+        id: coverage
-        with:
+        run: |
-          config: ./.testcoverage.yml
+          go install github.com/vladopajic/go-test-coverage/v2@latest
-
+          go-test-coverage --config ./.testcoverage.yml --github-action-output
-      # Download baseline coverage from main branch (for PRs)
       - name: Download baseline coverage
         if: gitea.event_name == 'pull_request'
         uses: actions/download-artifact@v3
@@ -30,14 +29,12 @@ jobs:
           name: coverage-baseline
           path: ./baseline
         continue-on-error: true
-
-      # Compare coverage against baseline (for PRs)
       - name: Compare coverage
         if: gitea.event_name == 'pull_request'
         run: |
-          CURRENT=$(go tool cover -func=coverage.txt | grep "^total:" | awk '{print $NF}' | tr -d '%')
+          CURRENT="${{ steps.coverage.outputs.total-coverage }}"
           if [ -f ./baseline/coverage.txt ]; then
-            BASE=$(go tool cover -func=./baseline/coverage.txt | grep "^total:" | awk '{print $NF}' | tr -d '%')
+            BASE=$(cat ./baseline/coverage.txt)
             echo "Base coverage: ${BASE}%"
             echo "Current coverage: ${CURRENT}%"
             if [ "$(echo "$CURRENT < $BASE" | bc -l)" -eq 1 ]; then
@@ -49,8 +46,9 @@ jobs:
             echo "No baseline coverage found, skipping comparison"
             echo "Current coverage: ${CURRENT}%"
           fi
-
+      - name: Save coverage baseline
-      # Upload coverage as baseline (only on main)
+        if: gitea.ref == 'refs/heads/main'
+        run: echo "${{ steps.coverage.outputs.total-coverage }}" > coverage.txt
       - name: Upload coverage baseline
         if: gitea.ref == 'refs/heads/main'
         uses: actions/upload-artifact@v3
@@ -58,25 +56,23 @@ jobs:
           name: coverage-baseline
           path: coverage.txt
           retention-days: 90
-
-      # Post coverage to PR comment
       - name: Post coverage comment
         if: gitea.event_name == 'pull_request'
         env:
           GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
           GITEA_URL: ${{ gitea.server_url }}
         run: |
-          COVERAGE=$(go tool cover -func=coverage.txt | grep "^total:" | awk '{print $NF}')
+          COVERAGE="${{ steps.coverage.outputs.total-coverage }}"
           curl -X POST "${GITEA_URL}/api/v1/repos/${{ gitea.repository }}/issues/${{ gitea.event.pull_request.number }}/comments" \
             -H "Authorization: token ${GITEA_TOKEN}" \
             -H "Content-Type: application/json" \
-            -d "{\"body\": \"## Coverage Report\n\nTotal coverage: **${COVERAGE}**\"}"
+            -d "{\"body\": \"## Coverage Report\n\nTotal coverage: **${COVERAGE}%**\"}"
 
   vulnerabilities:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
-      - uses: actions/setup-go@v6
+      - uses: actions/setup-go@v7
         with:
           go-version: 'stable'
       - name: Check vulnerabilities

.gitea/workflows/pre-commit.yaml

@@ -13,11 +13,11 @@ jobs:
     env:
       SKIP: no-commit-to-branch
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
-      - uses: actions/setup-go@v6
+      - uses: actions/setup-go@v7
         with:
           go-version: stable
-      - uses: actions/setup-python@v6
+      - uses: actions/setup-python@v7
         with:
           python-version: '3.14'
       - name: Install goimports

.pre-commit-config.yaml

@@ -11,7 +11,7 @@ repos:
     - --allow-multiple-documents
   - id: check-added-large-files
 - repo: https://github.com/alessandrojcm/commitlint-pre-commit-hook
-  rev: v9.24.0
+  rev: v9.26.0
   hooks:
   - id: commitlint
     stages: [ commit-msg ]
@@ -30,10 +30,10 @@ repos:
   - id: go-test
   - id: gofumpt
 - repo: https://github.com/golangci/golangci-lint
-  rev: v2.8.0
+  rev: v2.13.1
   hooks:
   - id: golangci-lint-full
 - repo: https://github.com/gitleaks/gitleaks
-  rev: v8.30.0
+  rev: v8.30.1
   hooks:
   - id: gitleaks

.version

@@ -1,3 +1,3 @@
 {
-  "version": "v0.4.1"
+  "version": "v0.5.1"
 }

CHANGELOG.md

@@ -2,6 +2,53 @@
 
 All notable changes to this project will be documented in this file.
 
+## [0.5.1] - 2026-08-21
+
+### 🐛 Bug Fixes
+
+- *(ci)* Use go-test-coverage binary directly to fix Gitea Actions (#303)
+- *(deps)* Update module github.com/stretchr/testify to v1.12.0 (#319)
+- *(deps)* Update module github.com/stretchr/testify to v1.12.1 (#321)
+
+### ⚙️ Miscellaneous Tasks
+
+- *(deps)* Update pre-commit hook gitleaks/gitleaks to v8.30.1 (#296)
+- *(deps)* Update pre-commit hook golangci/golangci-lint to v2.11.4 (#298)
+- *(deps)* Update dependency go to v1.26.2 (#300)
+- *(deps)* Update pre-commit hook alessandrojcm/commitlint-pre-commit-hook to v9.25.0 (#304)
+- *(deps)* Update pre-commit hook golangci/golangci-lint to v2.12.0 (#306)
+- *(deps)* Update pre-commit hook golangci/golangci-lint to v2.12.1 (#308)
+- *(deps)* Update pre-commit hook golangci/golangci-lint to v2.12.2 (#309)
+- *(deps)* Update actions/checkout action to v7 (#311)
+- *(deps)* Update pre-commit hook alessandrojcm/commitlint-pre-commit-hook to v9.26.0 (#313)
+- *(deps)* Update actions/setup-go action to v7 (#315)
+- *(deps)* Update actions/setup-python action to v7 (#317)
+- *(deps)* Update pre-commit hook golangci/golangci-lint to v2.13.1 (#322)
+
+## [0.5.0] - 2026-03-12
+
+### 🚀 Features
+
+- *(client)* Add API key authentication for /authz endpoint (#294)
+
+### ⚙️ Miscellaneous Tasks
+
+- *(deps)* Update golang:1.25.5 docker digest to 3a01526 (#271)
+- *(deps)* Update pre-commit hook alessandrojcm/commitlint-pre-commit-hook to v9.24.0 (#273)
+- *(deps)* Update dependency go to v1.25.6 (#274)
+- *(deps)* Update golang docker tag to v1.25.6 (#275)
+- Remove GitLab CI configuration
+- Add code coverage integration
+- *(deps)* Update dependency go to v1.25.7 (#279)
+- *(deps)* Update dependency go to v1.26.0 (#280)
+- *(deps)* Update pre-commit hook golangci/golangci-lint to v2.9.0 (#281)
+- *(deps)* Update pre-commit hook golangci/golangci-lint to v2.10.0 (#282)
+- *(deps)* Update pre-commit hook golangci/golangci-lint to v2.10.1 (#283)
+- *(deps)* Update dependency go to v1.26.1 (#286)
+- *(deps)* Update pre-commit hook golangci/golangci-lint to v2.11.1 (#288)
+- *(deps)* Update pre-commit hook golangci/golangci-lint to v2.11.2 (#290)
+- *(deps)* Update pre-commit hook golangci/golangci-lint to v2.11.3 (#292)
+
 ## [0.4.1] - 2026-01-09
 
 ### ⚙️ Miscellaneous Tasks

client.go

@@ -28,6 +28,7 @@ type PrivilegeHandler struct {
 	*sync.RWMutex
 	client     *http.Client
 	baseURL    string
+	apiKey     string
 	privileges map[string]map[string]*CompanyPrivileges
 }
 
@@ -41,6 +42,13 @@ func WithBaseURL(url string) OptsFunc {
 	}
 }
 
+// WithAPIKey sets an API key used as a Bearer token when fetching privileges
+func WithAPIKey(key string) OptsFunc {
+	return func(handler *PrivilegeHandler) {
+		handler.apiKey = key
+	}
+}
+
 // New creates a new PrivilegeHandler. Pass OptsFuncs to configure.
 func New(opts ...OptsFunc) *PrivilegeHandler {
 	handler := &PrivilegeHandler{
@@ -57,7 +65,16 @@ func New(opts ...OptsFunc) *PrivilegeHandler {
 
 // Fetch the initial set of privileges from an authz-service
 func (h *PrivilegeHandler) Fetch() error {
-	resp, err := h.client.Get(fmt.Sprintf("%s/authz", h.baseURL))
+	req, err := http.NewRequest(http.MethodGet, fmt.Sprintf("%s/authz", h.baseURL), nil)
+	if err != nil {
+		return err
+	}
+
+	if h.apiKey != "" {
+		req.Header.Set("Authorization", "Bearer "+h.apiKey)
+	}
+
+	resp, err := h.client.Do(req)
 	if err != nil {
 		return err
 	}
@@ -87,13 +104,14 @@ func (h *PrivilegeHandler) Setup() []goamqp.Setup {
 
 // Process privilege-related events and update the internal state
 func (h *PrivilegeHandler) Process(msg interface{}, _ goamqp.Headers) (interface{}, error) {
+	h.Lock()
+	defer h.Unlock()
+
 	switch ev := msg.(type) {
 	case *UserAdded:
 		if priv, exists := h.privileges[ev.Email]; exists {
 			priv[ev.CompanyID] = &CompanyPrivileges{}
 		} else {
-			h.Lock()
-			defer h.Unlock()
 			h.privileges[ev.Email] = map[string]*CompanyPrivileges{
 				ev.CompanyID: {},
 			}
@@ -101,19 +119,13 @@ func (h *PrivilegeHandler) Process(msg interface{}, _ goamqp.Headers) (interface
 		return nil, nil
 	case *UserRemoved:
 		if priv, exists := h.privileges[ev.Email]; exists {
-			h.Lock()
-			defer h.Unlock()
 			delete(priv, ev.CompanyID)
 		}
 		return nil, nil
 	case *PrivilegeAdded:
-		h.Lock()
-		defer h.Unlock()
 		h.setPrivileges(ev.Email, ev.CompanyID, ev.Privilege, true)
 		return nil, nil
 	case *PrivilegeRemoved:
-		h.Lock()
-		defer h.Unlock()
 		h.setPrivileges(ev.Email, ev.CompanyID, ev.Privilege, false)
 		return nil, nil
 	default:

client_test.go

@@ -251,6 +251,39 @@ func TestPrivilegeHandler_IsAllowed_Return_True_If_Privilege_Exists(t *testing.T
 	assert.True(t, result)
 }
 
+func TestPrivilegeHandler_Fetch_Sends_Authorization_Header_When_APIKey_Set(t *testing.T) {
+	var receivedAuth string
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		receivedAuth = r.Header.Get("Authorization")
+		_, _ = w.Write([]byte("{}"))
+	}))
+	defer server.Close()
+
+	handler := New(
+		WithBaseURL(server.URL),
+		WithAPIKey("my-secret-key"),
+	)
+
+	err := handler.Fetch()
+	assert.NoError(t, err)
+	assert.Equal(t, "Bearer my-secret-key", receivedAuth)
+}
+
+func TestPrivilegeHandler_Fetch_No_Authorization_Header_Without_APIKey(t *testing.T) {
+	var receivedAuth string
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		receivedAuth = r.Header.Get("Authorization")
+		_, _ = w.Write([]byte("{}"))
+	}))
+	defer server.Close()
+
+	handler := New(WithBaseURL(server.URL))
+
+	err := handler.Fetch()
+	assert.NoError(t, err)
+	assert.Empty(t, receivedAuth)
+}
+
 func TestPrivilegeHandler_Fetch_Error_Response(t *testing.T) {
 	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		w.WriteHeader(500)

go.mod

@@ -1,19 +1,15 @@
 module gitea.unbound.se/shiny/authz_client
 
-go 1.22.12
+go 1.26.2
-
-toolchain go1.25.6
 
 require (
 	github.com/sparetimecoders/goamqp v0.3.3
-	github.com/stretchr/testify v1.11.1
+	github.com/stretchr/testify v1.12.1
 )
 
 require (
-	github.com/davecgh/go-spew v1.1.1 // indirect
 	github.com/google/uuid v1.6.0 // indirect
 	github.com/pkg/errors v0.9.1 // indirect
-	github.com/pmezard/go-difflib v1.0.0 // indirect
 	github.com/rabbitmq/amqp091-go v1.10.0 // indirect
-	gopkg.in/yaml.v3 v3.0.1 // indirect
+	go.yaml.in/yaml/v3 v3.0.5 // indirect
 )

go.sum

@@ -1,20 +1,14 @@
-github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
-github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
 github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
 github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
 github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
-github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
-github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/rabbitmq/amqp091-go v1.10.0 h1:STpn5XsHlHGcecLmMFCtg7mqq0RnD+zFr4uzukfVhBw=
 github.com/rabbitmq/amqp091-go v1.10.0/go.mod h1:Hy4jKW5kQART1u+JkDTF9YYOQUHXqMuhrgxOEeS7G4o=
 github.com/sparetimecoders/goamqp v0.3.3 h1:z/nfTPmrjeU/rIVuNOgsVLCimp3WFoNFvS3ZzXRJ6HE=
 github.com/sparetimecoders/goamqp v0.3.3/go.mod h1:W9NRCpWLE+Vruv2dcRSbszNil2O826d2Nv6kAkETW5o=
-github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
+github.com/stretchr/testify v1.12.1 h1:EuwCh5fleGS7H32xRwO3wRGT7DxrDhLAT6FF8MpWDWE=
-github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
+github.com/stretchr/testify v1.12.1/go.mod h1:MDEgiDPPsNp5cuIrHPPCyornHKgEVbtFUmoNlxoYthg=
 go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto=
 go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE=
-gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405 h1:yhCVgyC4o1eVCa2tZl7eS0r+SDo693bJlVdllGtEeKM=
+go.yaml.in/yaml/v3 v3.0.5 h1:N6y/pJk8buWs9NY5ERU2HSMfm+IuD/OtfdAnq6kESPw=
-gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+go.yaml.in/yaml/v3 v3.0.5/go.mod h1:HVTZu1O7/Vkt2N+BFy8Zza+lnLsABggaTM2ZpNIGuKg=
-gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
-gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=