feat(release): publish grpc-versions.txt artifact (PR 2 / Task 2)#597
Merged
Conversation
…sync Pins protoc-gen-go (via google.golang.org/protobuf) and protoc-gen-go-grpc in tools.go (build-tag `tools`), and emits a `grpc-versions.txt` release artifact listing the exact gRPC/protobuf/proto-gen versions this workflow release was built against. Downstream plugins (e.g. workflow-plugin- digitalocean) gate their proto toolchain pins against this file so they link against ABI-compatible versions when implementing the typed pb.IaCProvider services. Foundation for PR 2 of docs/plans/2026-05-10-strict-contracts-force-cutover.md (Task 2). No runtime impact; release-pipeline-only change. Rollback: revert this commit; release pipeline drops back to prior state, no state migration required. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Contributor
There was a problem hiding this comment.
Pull request overview
Adds release-time provenance for the gRPC/protobuf toolchain by pinning the relevant generator modules and emitting a grpc-versions.txt artifact during the GitHub Release workflow, so downstream plugins can align their pins to ABI-compatible versions.
Changes:
- Add a
tools.go(build-tagged) file that blank-importsprotoc-gen-goandprotoc-gen-go-grpcto keep generator deps tracked. - Pin
google.golang.org/grpc/cmd/protoc-gen-go-grpcingo.mod/go.sum. - Extend
.github/workflows/release.ymlto generate and publishdist/grpc-versions.txt.
Reviewed changes
Copilot reviewed 3 out of 4 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
| tools.go | Introduces build-tagged tool dependency pinning for protoc generators. |
| go.mod | Adds an explicit requirement for protoc-gen-go-grpc module. |
| go.sum | Records sums for the newly pinned protoc-gen-go-grpc module. |
| .github/workflows/release.yml | Generates dist/grpc-versions.txt as part of the release artifact set. |
Comment on lines
+1
to
+16
| //go:build tools | ||
| // +build tools | ||
|
|
||
| // This file pins build-time tool dependencies that are not imported by | ||
| // runtime code. Listed here so `go mod tidy` keeps them in go.mod/go.sum and | ||
| // so the release pipeline can resolve their exact versions for the | ||
| // grpc-versions.txt artifact (cross-repo dep sync foundation per | ||
| // 2026-05-10-strict-contracts-force-cutover Task 2). | ||
| // | ||
| // Guarded by the `tools` build tag so it is excluded from normal builds | ||
| // (avoids package-name conflict with the rest of the workflow root). | ||
| package workflow | ||
|
|
||
| import ( | ||
| _ "google.golang.org/grpc/cmd/protoc-gen-go-grpc" | ||
| _ "google.golang.org/protobuf/cmd/protoc-gen-go" |
Spec-review MINOR finding on PR #597: line resolving protoc-gen-go's version against `google.golang.org/protobuf` (rather than the spec's literal `google.golang.org/protobuf/cmd/protoc-gen-go`, which is NOT a standalone module) reads as copy-paste. Add inline comment to disambiguate the dedup as intentional. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
⏱ Benchmark Results✅ No significant performance regressions detected. benchstat comparison (baseline → PR)
|
….{mod,sum}
Adding google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.6.1 to the root
go.mod (Task 2's tools.go pin) propagates as an indirect dep into the
example/ submodule's graph. The Go Mod Tidy CI gate caught the drift
on PR #597. Refresh example/go.{mod,sum} via `go mod tidy` (with
GOPRIVATE=github.com/GoCodeAlone/*) so the workspace's example module
matches the parent root.
## Plan-correction notes
Plan §Task 2 (rev5 @ e82b7e0c) had two specification bugs that this PR
fixes-forward without scope-lock amendment (intent preserved, PR count
unchanged):
1. Step 4 verification command `go build -tags tools ./...` is impossible
by Go language semantics — `protoc-gen-go` and `protoc-gen-go-grpc`
are `package main` and main packages aren't importable. Substituted
with: `go mod tidy && go build ./... && go list -m all | grep
protoc-gen` to achieve the spec intent (verify tool dependencies
resolve and pin).
2. Step 2 dependency `google.golang.org/protobuf/cmd/protoc-gen-go` is a
package inside the protobuf module, not a standalone module.
Substituted parent module path with same target version.
Spec-reviewer ack'd the substitutions on the team channel; team-lead
chose PR-record capture over ADR (manifest unchanged, intent preserved,
audit trail in the reviewer chain).
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Comment on lines
+1
to
+11
| //go:build tools | ||
| // +build tools | ||
|
|
||
| // This file pins build-time tool dependencies that are not imported by | ||
| // runtime code. Listed here so `go mod tidy` keeps them in go.mod/go.sum and | ||
| // so the release pipeline can resolve their exact versions for the | ||
| // grpc-versions.txt artifact (cross-repo dep sync foundation per | ||
| // 2026-05-10-strict-contracts-force-cutover Task 2). | ||
| // | ||
| // Guarded by the `tools` build tag so it is excluded from normal builds | ||
| // (avoids package-name conflict with the rest of the workflow root). |
| golang.org/x/tools v0.44.0 | ||
| google.golang.org/api v0.272.0 | ||
| google.golang.org/grpc v1.80.0 | ||
| google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.6.1 |
| google.golang.org/grpc v1.80.0 // indirect | ||
| google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.6.1 // indirect | ||
| google.golang.org/protobuf v1.36.11 // indirect | ||
| gopkg.in/evanphx/json-patch.v4 v4.13.0 // indirect |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
protoc-gen-go(viagoogle.golang.org/protobuf) andprotoc-gen-go-grpcintools.go(build-tagtools) sogo mod tidykeeps them tracked ingo.mod/go.sum.grpc-versions.txtlisting the exactgrpc/protobuf/protoc-gen-go/protoc-gen-go-grpcversions this workflow release was built against.dist/*via the existingsoftprops/action-gh-release@v2step (covered bychecksums.txt).example/go.{mod,sum}so the Go Mod Tidy CI gate stays green.Why
Foundation for PR 2 of
docs/plans/2026-05-10-strict-contracts-force-cutover.md(Task 2). Downstream plugins (e.g.workflow-plugin-digitalocean) gate their proto toolchain pins against this file so they link against ABI-compatible gRPC/protobuf versions when implementing the typedpb.IaCProviderservices.No runtime impact; release-pipeline-only change.
Plan-correction notes
Plan §Task 2 (rev5 @ e82b7e0c) had two specification bugs that this PR fixes-forward without scope-lock amendment (intent preserved, PR count unchanged):
Step 4 verification command
go build -tags tools ./...is impossible by Go language semantics —protoc-gen-goandprotoc-gen-go-grpcarepackage mainand main packages aren't importable. Substituted with:go mod tidy && go build ./... && go list -m all | grep protoc-gento achieve the spec intent (verify tool dependencies resolve and pin).Step 2 dependency
google.golang.org/protobuf/cmd/protoc-gen-gois a package inside the protobuf module, not a standalone module. Substituted parent module path with same target version.Spec-reviewer ack'd the substitutions on the team channel; team-lead chose PR-record capture over ADR (manifest unchanged, intent preserved, audit trail in the reviewer chain).
Local dry-run
Test plan
GOWORK=off go build ./...— cleanGOWORK=off go vet ./...— cleanGOWORK=off go test -count=1 -run='^$' ./...— all packages compile (no test runs needed)GOPRIVATE='github.com/GoCodeAlone/*' GOWORK=off go mod tidyinexample/— no further drift after the indirect-dep refreshactionlint .github/workflows/release.yml— no findings introduced by this PR (the two pre-existing shellcheck warnings on lines 145/283 are out of scope)v1.0.0-rc1in PR 4 cutover)Rollback
Revert the commits on this branch. Release pipeline drops back to prior state; no state migration required.
🤖 Generated with Claude Code