• Home
  • Features
  • Pricing
  • Docs
  • Announcements
  • Sign In

pomerium / pomerium / 24468250111
45%

Build:
DEFAULT BRANCH: main
Ran 15 Apr 2026 05:36PM UTC
Jobs 1
Files 691
Run time 2min
Badge
Embed ▾
README BADGES
x

If you need to use a raster PNG badge, change the '.svg' to '.png' in the link

Markdown

Textile

RDoc

HTML

Rst

15 Apr 2026 05:19PM UTC coverage: 45.438% (-0.03%) from 45.47%
24468250111

push

github

web-flow
fix: use X-Serverless-Authorization for Cloud Run serverless auth (#6268)

## Summary

Cloud Run supports `X-Serverless-Authorization` as a native alternative
to `Authorization` for IAM authentication. When present, Cloud Run uses
it for IAM and passes `Authorization` through to the container
untouched.

Switch to `X-Serverless-Authorization` unconditionally. This frees the
`Authorization` header for application-level use (`set_request_headers`,
MCP upstream OAuth, etc.) and fixes an incompatibility where MCP server
routes strip `Authorization` via `headers_to_remove`, which also deletes
the GCP identity token.

See: https://cloud.google.com/run/docs/authenticating/service-to-service

## Related issues

- ENG-3912

## User Explanation

Google Cloud Run serverless authentication now uses the
`X-Serverless-Authorization` header instead of `Authorization`. Cloud
Run checks this header first for IAM authentication. This frees the
`Authorization` header for application-level use and fixes MCP server
routes with Cloud Run auth.

## Checklist

- [x] reference any related issues
- [x] updated unit tests
- [ ] add appropriate label (`enhancement`, `bug`, `breaking`,
`dependencies`, `ci`)
- [ ] ready for review

1 of 1 new or added line in 1 file covered. (100.0%)

35 existing lines in 10 files now uncovered.

35132 of 77319 relevant lines covered (45.44%)

115.06 hits per line

Coverage Regressions

Lines Coverage ∆ File
7
72.3
-4.73% pkg/grpcutil/client_manager.go
6
89.22
-1.47% config/config_source.go
6
75.99
-1.32% pkg/storage/postgres/backend.go
5
48.64
-0.54% internal/databroker/server_clustered_follower.go
3
57.0
-0.74% internal/controlplane/server.go
2
94.55
0.0% pkg/fanout/receive.go
2
83.51
-0.43% pkg/ssh/auth.go
2
88.08
-0.44% pkg/storage/postgres/postgres.go
1
82.24
-0.2% pkg/envoy/resource_monitor_linux.go
1
75.41
0.0% pkg/storage/postgres/registry.go
Jobs
ID Job ID Ran Files Coverage
1 24468250111.1 15 Apr 2026 05:36PM UTC 691
45.44
GitHub Action Run
Source Files on build 24468250111
  • Tree
  • List 691
  • Changed 12
  • Source Changed 1
  • Coverage Changed 12
Coverage ∆ File Lines Relevant Covered Missed Hits/Line
  • Back to Repo
  • Github Actions Build #24468250111
  • 2a69e6a7 on github
  • Prev Build on main (#24464779927)
  • Next Build on main (#24517487607)
STATUS · Troubleshooting · Open an Issue · Sales · Support · CAREERS · ENTERPRISE · START FREE · SCHEDULE DEMO
ANNOUNCEMENTS · TWITTER · TOS & SLA · Supported CI Services · What's a CI service? · Automated Testing

© 2026 Coveralls, Inc