renovate/supply chain: BSR remote plugins in buf.gen*.yaml bypass minimumReleaseAge and are rate-limited — sweep the fleet

[krisarmstrong]

Two defects in buf.gen*.yaml remote plugins, found in trellis 2026-09-15

A remote: buf.build/<org>/<plugin> entry is a BSR RPC that serves whatever was
released last.

1. It bypasses the embargo. .npmrc's min-release-age=7 and Renovate's
   minimumReleaseAge cover the npm registry, not BSR. Measured on a clean
   origin/main: ui/package.json pinned @bufbuild/protobuf 2.14.1 — the
   newest version the embargo allows — while BSR served protoc-gen-es
   v2.15.0, so a plain make generate-ts rewrote generated code to a plugin
   version the repo's own supply-chain guard refuses.
2. It is rate-limited. Anonymous BSR calls return resource_exhausted: too many requests after a handful in a few minutes. A GitHub-hosted runner
   shares its egress with every other anonymous caller, so any CI gate built on
   remote plugins is flaky-red by construction. Buf's documented fix is a
   BUF_TOKEN secret — a credential, and a human-gated one.

Together they make a generated-code drift gate impossible, which is how this
was found (MustardSeedNetworks/trellis#471).

What trellis did

Switched to local plugins, pinned where the existing managers already look:

• protoc-gen-go / protoc-gen-connect-go: Makefile go install <module>@<version>
  lines — the org preset's Go-tool customManager reads these, so they move with
  go.mod's google.golang.org/protobuf and connectrpc.com/connect.
• protoc-gen-es: a ui/package.json devDependency pinned exact to the
  @bufbuild/protobuf runtime — the npm manager sees it and the embargo covers it.

Generation is then reproducible (byte-identical to the committed tree), makes no
network call, and needs no new Renovate manager.

Ask (fleet)

Sweep the siblings for buf.gen*.yaml with remote: plugins — seed, stem,
niac, foundation — and move them the same way. No default.json change is
needed if they follow trellis's shape; a customManager for buf.gen*.yaml
would only be needed if a repo keeps remote plugins, which the two defects above
argue against.

[krisarmstrong]

One consequence for whoever picks up the sweep: with local pinned plugins, the first Renovate bump of any plugin pin opens a PR that is born red — the plugin version changes, the stamp committed in gen/ / ui/src/gen/ does not, and the drift gate fires. That is the gate working, not a defect, and the fix is make generate generate-ts and commit on the Renovate branch — never revert the bump.

So group each plugin with the runtime it mirrors (protoc-gen-go with google.golang.org/protobuf, protoc-gen-connect-go with connectrpc.com/connect, @bufbuild/protoc-gen-es with @bufbuild/protobuf), and expect a regenerate-and-push step on those PRs. Going local makes the pins visible and embargoed; it does not make them self-service.