From 99ce80d6eaf39fb6ce1ef50c0a4653704a007baa Mon Sep 17 00:00:00 2001 From: Jon Langevin Date: Sun, 10 May 2026 02:06:55 -0400 Subject: [PATCH 1/3] feat(release): publish grpc-versions.txt artifact for cross-repo dep sync Pins protoc-gen-go (via google.golang.org/protobuf) and protoc-gen-go-grpc in tools.go (build-tag `tools`), and emits a `grpc-versions.txt` release artifact listing the exact gRPC/protobuf/proto-gen versions this workflow release was built against. Downstream plugins (e.g. workflow-plugin- digitalocean) gate their proto toolchain pins against this file so they link against ABI-compatible versions when implementing the typed pb.IaCProvider services. Foundation for PR 2 of docs/plans/2026-05-10-strict-contracts-force-cutover.md (Task 2). No runtime impact; release-pipeline-only change. Rollback: revert this commit; release pipeline drops back to prior state, no state migration required. Co-Authored-By: Claude Opus 4.7 --- .github/workflows/release.yml | 23 +++++++++++++++++++++++ go.mod | 1 + go.sum | 2 ++ tools.go | 17 +++++++++++++++++ 4 files changed, 43 insertions(+) create mode 100644 tools.go diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 18273e52..1f212fe0 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -256,6 +256,29 @@ jobs: name: admin-ui path: dist + - name: Set up Go + uses: actions/setup-go@v5 + with: + go-version: '1.26' + cache: true + + - name: Generate grpc-versions.txt + # Cross-repo dep-sync foundation per + # docs/plans/2026-05-10-strict-contracts-force-cutover.md Task 2. + # Downstream plugins (e.g. workflow-plugin-digitalocean) gate their + # protoc / proto-gen toolchain pins against this artifact so they + # link against gRPC/protobuf versions ABI-compatible with this + # workflow release. + run: | + set -euo pipefail + { + echo "grpc=$(go list -m -json google.golang.org/grpc | jq -r .Version)" + echo "protobuf=$(go list -m -json google.golang.org/protobuf | jq -r .Version)" + echo "protoc-gen-go=$(go list -m -json google.golang.org/protobuf | jq -r .Version)" + echo "protoc-gen-go-grpc=$(go list -m -json google.golang.org/grpc/cmd/protoc-gen-go-grpc | jq -r .Version)" + } > dist/grpc-versions.txt + cat dist/grpc-versions.txt + - name: Create checksums run: | cd dist diff --git a/go.mod b/go.mod index 1c5cb284..9f797c19 100644 --- a/go.mod +++ b/go.mod @@ -79,6 +79,7 @@ require ( golang.org/x/tools v0.44.0 google.golang.org/api v0.272.0 google.golang.org/grpc v1.80.0 + google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.6.1 google.golang.org/protobuf v1.36.11 gopkg.in/yaml.v3 v3.0.1 k8s.io/api v0.35.4 diff --git a/go.sum b/go.sum index b348bb85..4d7b7175 100644 --- a/go.sum +++ b/go.sum @@ -980,6 +980,8 @@ google.golang.org/genproto/googleapis/rpc v0.0.0-20260420184626-e10c466a9529 h1: google.golang.org/genproto/googleapis/rpc v0.0.0-20260420184626-e10c466a9529/go.mod h1:4Hqkh8ycfw05ld/3BWL7rJOSfebL2Q+DVDeRgYgxUU8= google.golang.org/grpc v1.80.0 h1:Xr6m2WmWZLETvUNvIUmeD5OAagMw3FiKmMlTdViWsHM= google.golang.org/grpc v1.80.0/go.mod h1:ho/dLnxwi3EDJA4Zghp7k2Ec1+c2jqup0bFkw07bwF4= +google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.6.1 h1:/WILD1UcXj/ujCxgoL/DvRgt2CP3txG8+FwkUbb9110= +google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.6.1/go.mod h1:YNKnb2OAApgYn2oYY47Rn7alMr1zWjb2U8Q0aoGWiNc= google.golang.org/protobuf v0.0.0-20200109180630-ec00e32a8dfd/go.mod h1:DFci5gLYBciE7Vtevhsrf46CRTquxDuWsQurQQe4oz8= google.golang.org/protobuf v0.0.0-20200221191635-4d8936d0db64/go.mod h1:kwYJMbMJ01Woi6D6+Kah6886xMZcty6N08ah7+eCXa0= google.golang.org/protobuf v0.0.0-20200228230310-ab0ca4ff8a60/go.mod h1:cfTl7dwQJ+fmap5saPgwCLgHXTUD7jkjRqWcaiX5VyM= diff --git a/tools.go b/tools.go new file mode 100644 index 00000000..89f006fb --- /dev/null +++ b/tools.go @@ -0,0 +1,17 @@ +//go:build tools +// +build tools + +// This file pins build-time tool dependencies that are not imported by +// runtime code. Listed here so `go mod tidy` keeps them in go.mod/go.sum and +// so the release pipeline can resolve their exact versions for the +// grpc-versions.txt artifact (cross-repo dep sync foundation per +// 2026-05-10-strict-contracts-force-cutover Task 2). +// +// Guarded by the `tools` build tag so it is excluded from normal builds +// (avoids package-name conflict with the rest of the workflow root). +package workflow + +import ( + _ "google.golang.org/grpc/cmd/protoc-gen-go-grpc" + _ "google.golang.org/protobuf/cmd/protoc-gen-go" +) From 417f3b2d1cbe03786d22a77378839b8ee730f5c3 Mon Sep 17 00:00:00 2001 From: Jon Langevin Date: Sun, 10 May 2026 02:11:18 -0400 Subject: [PATCH 2/3] docs(release): clarify protoc-gen-go shares protobuf module version Spec-review MINOR finding on PR #597: line resolving protoc-gen-go's version against `google.golang.org/protobuf` (rather than the spec's literal `google.golang.org/protobuf/cmd/protoc-gen-go`, which is NOT a standalone module) reads as copy-paste. Add inline comment to disambiguate the dedup as intentional. Co-Authored-By: Claude Opus 4.7 --- .github/workflows/release.yml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 1f212fe0..a1f11f99 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -271,6 +271,10 @@ jobs: # workflow release. run: | set -euo pipefail + # protoc-gen-go ships from the google.golang.org/protobuf module + # (path google.golang.org/protobuf/cmd/protoc-gen-go is NOT a + # standalone module), so its version line resolves against the + # parent module — same Version, intentional dedup, not a copy-paste. { echo "grpc=$(go list -m -json google.golang.org/grpc | jq -r .Version)" echo "protobuf=$(go list -m -json google.golang.org/protobuf | jq -r .Version)" From 446e52fa1c0781098c203f75b0e8d8f96ed0f3a5 Mon Sep 17 00:00:00 2001 From: Jon Langevin Date: Sun, 10 May 2026 02:22:03 -0400 Subject: [PATCH 3/3] fix(example): propagate protoc-gen-go-grpc indirect dep to example/go.{mod,sum} MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Adding google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.6.1 to the root go.mod (Task 2's tools.go pin) propagates as an indirect dep into the example/ submodule's graph. The Go Mod Tidy CI gate caught the drift on PR #597. Refresh example/go.{mod,sum} via `go mod tidy` (with GOPRIVATE=github.com/GoCodeAlone/*) so the workspace's example module matches the parent root. ## Plan-correction notes Plan §Task 2 (rev5 @ e82b7e0c) had two specification bugs that this PR fixes-forward without scope-lock amendment (intent preserved, PR count unchanged): 1. Step 4 verification command `go build -tags tools ./...` is impossible by Go language semantics — `protoc-gen-go` and `protoc-gen-go-grpc` are `package main` and main packages aren't importable. Substituted with: `go mod tidy && go build ./... && go list -m all | grep protoc-gen` to achieve the spec intent (verify tool dependencies resolve and pin). 2. Step 2 dependency `google.golang.org/protobuf/cmd/protoc-gen-go` is a package inside the protobuf module, not a standalone module. Substituted parent module path with same target version. Spec-reviewer ack'd the substitutions on the team channel; team-lead chose PR-record capture over ADR (manifest unchanged, intent preserved, audit trail in the reviewer chain). Co-Authored-By: Claude Opus 4.7 --- example/go.mod | 1 + example/go.sum | 2 ++ 2 files changed, 3 insertions(+) diff --git a/example/go.mod b/example/go.mod index 67383ef3..99dc0e51 100644 --- a/example/go.mod +++ b/example/go.mod @@ -232,6 +232,7 @@ require ( google.golang.org/genproto/googleapis/api v0.0.0-20260420184626-e10c466a9529 // indirect google.golang.org/genproto/googleapis/rpc v0.0.0-20260420184626-e10c466a9529 // indirect google.golang.org/grpc v1.80.0 // indirect + google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.6.1 // indirect google.golang.org/protobuf v1.36.11 // indirect gopkg.in/evanphx/json-patch.v4 v4.13.0 // indirect gopkg.in/inf.v0 v0.9.1 // indirect diff --git a/example/go.sum b/example/go.sum index 1b47cd7a..a9205a20 100644 --- a/example/go.sum +++ b/example/go.sum @@ -826,6 +826,8 @@ google.golang.org/genproto/googleapis/rpc v0.0.0-20260420184626-e10c466a9529 h1: google.golang.org/genproto/googleapis/rpc v0.0.0-20260420184626-e10c466a9529/go.mod h1:4Hqkh8ycfw05ld/3BWL7rJOSfebL2Q+DVDeRgYgxUU8= google.golang.org/grpc v1.80.0 h1:Xr6m2WmWZLETvUNvIUmeD5OAagMw3FiKmMlTdViWsHM= google.golang.org/grpc v1.80.0/go.mod h1:ho/dLnxwi3EDJA4Zghp7k2Ec1+c2jqup0bFkw07bwF4= +google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.6.1 h1:/WILD1UcXj/ujCxgoL/DvRgt2CP3txG8+FwkUbb9110= +google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.6.1/go.mod h1:YNKnb2OAApgYn2oYY47Rn7alMr1zWjb2U8Q0aoGWiNc= google.golang.org/protobuf v0.0.0-20200109180630-ec00e32a8dfd/go.mod h1:DFci5gLYBciE7Vtevhsrf46CRTquxDuWsQurQQe4oz8= google.golang.org/protobuf v0.0.0-20200221191635-4d8936d0db64/go.mod h1:kwYJMbMJ01Woi6D6+Kah6886xMZcty6N08ah7+eCXa0= google.golang.org/protobuf v0.0.0-20200228230310-ab0ca4ff8a60/go.mod h1:cfTl7dwQJ+fmap5saPgwCLgHXTUD7jkjRqWcaiX5VyM=