v0.1.5 — M8 hardening

Hardening release (#38, #39, #40) — core only.

Diagnostics

• Unknown-annotation and unknown-argument diagnostics now suggest the closest match: @Cacheble → did you mean @Cacheable?, arg limt → did you mean limit?.

Fixes

• config.EnvName now sanitizes the prefix as well as the key, so a dotted or hyphenated prefix can't produce an invalid environment-variable name.

Testing / CI

• New fuzz targets for the path-template and config-key parsers, wired into the fuzz-smoke CI job.
• Per-package coverage floors (§49.4) enforced by a new coverage floors CI job; runtime/config and compiler coverage raised.

No API changes; a drop-in upgrade from v0.1.4.

v0.1.4 — caching (@Cacheable/@CacheEvict)

Adds annotation-driven caching (#32, PR #50).

Runtime

• runtime.Cache (Get/Set/Delete with per-entry TTL) + MemoryCache, the in-process default wired into ProxyDependencies.

@Cacheable / @CacheEvict

On an interface-backed service method:

• @Cacheable(key="user:#{id}", ttl="1m") — read-through: cached value on a hit (target skipped), stored on a miss. Method must return (T, error); value is JSON-serialized. Key #{param} placeholders resolve to method arguments.
• @CacheEvict(key="…") — invalidates the entry after the method succeeds.

New module: adapters/redis (adapters/redis/v0.1.0)

runtime.Cache over redis/go-redis/v9 (WithPrefix, nil→miss, ttl 0 → no expiry). Install: go get github.com/zombocoder/goboot/adapters/redis@v0.1.0 (requires core v0.1.4).

Full coverage incl. an e2e proving hit-skips-target / evict-invalidates and a miniredis-backed adapter test.

v0.1.3 — OAuth2/OIDC authentication

Adds OAuth2/OIDC authentication for goboot APIs (#48, PR #49).

Runtime

• Principal (subject/username/roles/scopes/claims) + WithPrincipal/PrincipalFrom context helpers.
• Authenticator seam (request → Principal) with an AnonymousAuthenticator default.
• RoleAuthorizer — enforces @Authorize/@RolesAllowed against the context principal (401 unauthenticated, 403 insufficient), per Mode.
• Unauthenticated/Forbidden 401/403 error helpers.

HTTP wiring

Generated handlers now enforce route-level @Authorize: authenticate → WithPrincipal → authorize before binding. Secure by default — DefaultHTTPHandlerDependencies ships AnonymousAuthenticator + RoleAuthorizer, so a secured route returns 401 until an authenticator is configured. Also fixes a latent bug where @Authorize on a @RestController method errored as a service proxy.

New module: adapters/oidc (adapters/oidc/v0.1.0)

A runtime.Authenticator over an OIDC provider (Keycloak): discovery + JWKS caching, signature/iss/aud/exp verification, claims → Principal (realm + client roles). Install: go get github.com/zombocoder/goboot/adapters/oidc@v0.1.0 (requires core v0.1.3).

Full test coverage incl. a mock-provider integration test and an httptest 401/403/200 e2e.

v0.1.2

Patch release correcting the reported version strings.

v0.1.1 shipped with CLIVersion still set to 0.1.0 (the constant wasn't bumped before tagging), so goboot version reported the wrong number; the validate plugin likewise reported 0.1.0. This release bumps both to 0.1.2. No functional/API changes from v0.1.1 — it supersedes v0.1.1 (published tags are immutable).

Tags: v0.1.2, plugins/validate/v0.1.2.

v0.1.1

Adds the request-validation plugin and fixes the fresh-project generate experience.

New: plugins/validate

An AnnotationProvider + Analyzer + Generator that turns field-constraint annotations into a runtime.Validator, wired onto goboot's HTTP bind→validate step:

• @Required, @Min(n), @Max(n), @Size(min=,max=), @Pattern("re"), @Email
• Generates a type-switch validator that accumulates every failure into a 400 Problem.
• Analyzer reports type mismatches, uncompilable regexes, malformed @Size, and constraints on non-request types.

Install: add github.com/zombocoder/goboot/plugins/validate to goboot.yaml and wire httpDeps.Validator = generated.NewValidator().

Tag: plugins/validate/v0.1.1 (requires core v0.1.1).

Core

• Fresh-project generate fix — a composition root importing the not-yet-generated wiring no longer makes goboot generate fail on an empty/absent output directory (previously broke on every run with clean: true). The loader ignores load errors that stem solely from the absent output package, matched tightly so genuine errors still surface.
• model.Application.Package — exposes the generated output package name for Go-emitting plugins.
• Field-target AnnotatedDecls now carry their owning struct (Receiver), enabling field-driven generation via the deeper plugin API.

Closes #34.

---

⚠️ Superseded by v0.1.2, which corrects goboot version reporting 0.1.0. Prefer v0.1.2.

plugins/metrics v0.1.1

Ergonomics: @Counter/@Gauge now apply to a method, function, or any type — including a plain marker struct (previously only method/type, which errored with GOBANN003 on a struct). No breaking changes.

plugins/metrics v0.1.0

Prometheus metrics plugin (#35).

Turns @Counter / @Gauge(name=, help=, namespace=, labels=[…]) annotations into a generated file of registered Prometheus collectors: a var per metric, RegisterMetrics(reg), and a typed accessor per metric. For custom/business metrics; complements the automatic per-call @Timed.

Add to goboot.yaml:

plugins:
  - github.com/zombocoder/goboot/plugins/metrics@v0.1.0

then generated.RegisterMetrics(reg) and expose /metrics via promhttp. Requires core v0.1.5 and github.com/prometheus/client_golang in the target module.

adapters/mysql v0.1.0

Native MySQL driver adapter (#30).

db.DBProvider + TransactionManager over go-sql-driver/mysql, paired with the mysql SQL dialect. Reuses adapters/databasesql for the database/sql wrappers; adds driver registration and Open(dsn, opts...) (forces parseTime; pool sizing via WithMaxOpenConns/WithMaxIdleConns/WithConnMaxLifetime/WithConnMaxIdleTime).

Install: go get github.com/zombocoder/goboot/adapters/mysql@v0.1.0 (requires core v0.1.5). Pair with goboot generate -dialect mysql.

Verified against MySQL 8 (create → insert-in-tx → select → no-rows) plus hermetic sqlmock tests.

goboot v0.1.0

First public release of goboot — an annotation-driven, compile-time application framework for Go. You annotate ordinary Go types/methods (// @Service, // @RestController, // @GetMapping, // @Query, …); the goboot CLI reads them, builds a typed model + dependency graph, validates it, and generates plain, readable Go. No runtime reflection for DI, no classpath scanning.

Highlights

• DI & HTTP: constructor-injected components, controllers with all HTTP verbs, request binding/validation, RFC-7807 Problem errors, @ExceptionHandler advice, content negotiation.
• Repositories: @Query/@Exec/@Batch/@Call generated over a driver-neutral DB seam; dialects for postgres, mysql, sqlserver, question.
• Interception (service proxies): @Transactional, @Traced, @Timed, @Logged, @Audit, @Retry, @Timeout, @CircuitBreaker, @RateLimit, @Bulkhead, @Authorize.
• Config, lifecycle, scheduling: @ConfigurationProperties, @PostConstruct/@PreDestroy, @Scheduled, @Profile/conditionals.
• Plugins (compile-time, self-bootstrapping from goboot.yaml): plugins/oracle (dialect), plugins/openapi (OpenAPI 3 generator), plugins/lint (REST linter). Plugins can drive generation from their own annotations.
• Adapters (separate modules): adapters/pgx (PostgreSQL), adapters/otel (tracing), adapters/prometheus (metrics).
• Tooling: a VS Code extension (editors/vscode) that highlights annotations.

Install

go get github.com/zombocoder/goboot@v0.1.0
go install github.com/zombocoder/goboot/cmd/goboot@v0.1.0

Adapters/plugins are versioned per-submodule, e.g. go get github.com/zombocoder/goboot/adapters/pgx@v0.1.0.

Requires Go 1.25.