feat(release): publish grpc-versions.txt artifact (PR 2 / Task 2)

.github/workflows/release.yml

@@ -256,6 +256,33 @@ jobs:
         name: admin-ui
         path: dist
 
+    - name: Set up Go
+      uses: actions/setup-go@v5
+      with:
+        go-version: '1.26'
+        cache: true
+
+    - name: Generate grpc-versions.txt
+      # Cross-repo dep-sync foundation per
+      # docs/plans/2026-05-10-strict-contracts-force-cutover.md Task 2.
+      # Downstream plugins (e.g. workflow-plugin-digitalocean) gate their
+      # protoc / proto-gen toolchain pins against this artifact so they
+      # link against gRPC/protobuf versions ABI-compatible with this
+      # workflow release.
+      run: |
+        set -euo pipefail
+        # protoc-gen-go ships from the google.golang.org/protobuf module
+        # (path google.golang.org/protobuf/cmd/protoc-gen-go is NOT a
+        # standalone module), so its version line resolves against the
+        # parent module — same Version, intentional dedup, not a copy-paste.
+        {
+          echo "grpc=$(go list -m -json google.golang.org/grpc | jq -r .Version)"
+          echo "protobuf=$(go list -m -json google.golang.org/protobuf | jq -r .Version)"
+          echo "protoc-gen-go=$(go list -m -json google.golang.org/protobuf | jq -r .Version)"
+          echo "protoc-gen-go-grpc=$(go list -m -json google.golang.org/grpc/cmd/protoc-gen-go-grpc | jq -r .Version)"
+        } > dist/grpc-versions.txt
+        cat dist/grpc-versions.txt
+
     - name: Create checksums
       run: |
         cd dist

example/go.mod

@@ -232,6 +232,7 @@ require (
 	google.golang.org/genproto/googleapis/api v0.0.0-20260420184626-e10c466a9529 // indirect
 	google.golang.org/genproto/googleapis/rpc v0.0.0-20260420184626-e10c466a9529 // indirect
 	google.golang.org/grpc v1.80.0 // indirect
+	google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.6.1 // indirect
 	google.golang.org/protobuf v1.36.11 // indirect
 	gopkg.in/evanphx/json-patch.v4 v4.13.0 // indirect
 	gopkg.in/inf.v0 v0.9.1 // indirect

example/go.sum

@@ -826,6 +826,8 @@ google.golang.org/genproto/googleapis/rpc v0.0.0-20260420184626-e10c466a9529 h1:
 google.golang.org/genproto/googleapis/rpc v0.0.0-20260420184626-e10c466a9529/go.mod h1:4Hqkh8ycfw05ld/3BWL7rJOSfebL2Q+DVDeRgYgxUU8=
 google.golang.org/grpc v1.80.0 h1:Xr6m2WmWZLETvUNvIUmeD5OAagMw3FiKmMlTdViWsHM=
 google.golang.org/grpc v1.80.0/go.mod h1:ho/dLnxwi3EDJA4Zghp7k2Ec1+c2jqup0bFkw07bwF4=
+google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.6.1 h1:/WILD1UcXj/ujCxgoL/DvRgt2CP3txG8+FwkUbb9110=
+google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.6.1/go.mod h1:YNKnb2OAApgYn2oYY47Rn7alMr1zWjb2U8Q0aoGWiNc=
 google.golang.org/protobuf v0.0.0-20200109180630-ec00e32a8dfd/go.mod h1:DFci5gLYBciE7Vtevhsrf46CRTquxDuWsQurQQe4oz8=
 google.golang.org/protobuf v0.0.0-20200221191635-4d8936d0db64/go.mod h1:kwYJMbMJ01Woi6D6+Kah6886xMZcty6N08ah7+eCXa0=
 google.golang.org/protobuf v0.0.0-20200228230310-ab0ca4ff8a60/go.mod h1:cfTl7dwQJ+fmap5saPgwCLgHXTUD7jkjRqWcaiX5VyM=

go.mod

@@ -79,6 +79,7 @@ require (
 	golang.org/x/tools v0.44.0
 	google.golang.org/api v0.272.0
 	google.golang.org/grpc v1.80.0
+	google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.6.1
 	google.golang.org/protobuf v1.36.11
 	gopkg.in/yaml.v3 v3.0.1
 	k8s.io/api v0.35.4

go.sum

@@ -980,6 +980,8 @@ google.golang.org/genproto/googleapis/rpc v0.0.0-20260420184626-e10c466a9529 h1:
 google.golang.org/genproto/googleapis/rpc v0.0.0-20260420184626-e10c466a9529/go.mod h1:4Hqkh8ycfw05ld/3BWL7rJOSfebL2Q+DVDeRgYgxUU8=
 google.golang.org/grpc v1.80.0 h1:Xr6m2WmWZLETvUNvIUmeD5OAagMw3FiKmMlTdViWsHM=
 google.golang.org/grpc v1.80.0/go.mod h1:ho/dLnxwi3EDJA4Zghp7k2Ec1+c2jqup0bFkw07bwF4=
+google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.6.1 h1:/WILD1UcXj/ujCxgoL/DvRgt2CP3txG8+FwkUbb9110=
+google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.6.1/go.mod h1:YNKnb2OAApgYn2oYY47Rn7alMr1zWjb2U8Q0aoGWiNc=
 google.golang.org/protobuf v0.0.0-20200109180630-ec00e32a8dfd/go.mod h1:DFci5gLYBciE7Vtevhsrf46CRTquxDuWsQurQQe4oz8=
 google.golang.org/protobuf v0.0.0-20200221191635-4d8936d0db64/go.mod h1:kwYJMbMJ01Woi6D6+Kah6886xMZcty6N08ah7+eCXa0=
 google.golang.org/protobuf v0.0.0-20200228230310-ab0ca4ff8a60/go.mod h1:cfTl7dwQJ+fmap5saPgwCLgHXTUD7jkjRqWcaiX5VyM=

tools.go

@@ -0,0 +1,17 @@
+//go:build tools
+// +build tools
+
+// This file pins build-time tool dependencies that are not imported by
+// runtime code. Listed here so `go mod tidy` keeps them in go.mod/go.sum and
+// so the release pipeline can resolve their exact versions for the
+// grpc-versions.txt artifact (cross-repo dep sync foundation per
+// 2026-05-10-strict-contracts-force-cutover Task 2).
+//
+// Guarded by the `tools` build tag so it is excluded from normal builds
+// (avoids package-name conflict with the rest of the workflow root).
+package workflow
+
+import (
+	_ "google.golang.org/grpc/cmd/protoc-gen-go-grpc"
+	_ "google.golang.org/protobuf/cmd/protoc-gen-go"
+)