fix(ci): Proto generate without buf.build remote plugins by messagesgoel-blip · Pull Request #19 · Numeracode/verilink

messagesgoel-blip · 2026-07-30T14:04:27Z

Summary

Proto CI failed on buf generate with Failure: the server hosted at that remote is unavailable (BSR remote plugin outage), not a code drift issue.
Switch buf.gen.yaml to local go / go-grpc plugins and install pinned protoc-gen-go@v1.36.11 + protoc-gen-go-grpc@v1.6.2 in the Proto job (plus setup-go).

Test plan

Proto CI job green on this PR
Local: cd proto && buf lint && buf generate --template ../buf.gen.yaml then git diff --exit-code -- pkg/trustpb

Proto CI failed when buf.build remote plugin hosts were unavailable. Use pinned local protoc-gen-go / protoc-gen-go-grpc instead. Co-authored-by: Cursor <cursoragent@cursor.com>

gemini-code-assist · 2026-07-30T14:04:31Z

Caution

The consumer version of Gemini Code Assist on GitHub has been sunset. All code review activity has officially ceased.

cursor · 2026-07-30T14:04:32Z

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

coderabbitai · 2026-07-30T14:04:48Z

Warning

Review limit reached

You’ve reached a temporary PR review limit under our Fair Usage Limits Policy.

Your recent review volume is higher than typical usage, so adaptive limits are currently applied.

Next review available in: 40 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro

Run ID: 63cd71a3-1612-438b-ada8-696b8e22cee0

📥 Commits

Reviewing files that changed from the base of the PR and between 2b88d46 and 4774c17.

📒 Files selected for processing (3)

.github/workflows/ci.yml
buf.gen.yaml
scripts/gen-proto.sh

_{Comment @coderabbitai help to get the list of available commands.}

messagesgoel-blip · 2026-07-30T14:05:30Z

@coderabbitai review

coderabbitai · 2026-07-30T14:05:35Z

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

qodo-code-review · 2026-07-30T14:05:41Z

PR Summary by Qodo

fix(ci): Generate protos with local Go plugins (avoid buf.build remote outages)

🐞 Bug fix ⚙️ Configuration changes 🕐 10-20 Minutes

AI Description

• Make Proto CI resilient to buf.build remote plugin registry outages.
• Install pinned protoc-gen-go / protoc-gen-go-grpc in the Proto workflow job.
• Switch buf.gen.yaml to use local go/go-grpc plugins during buf generate.

Diagram

graph TD
  A["GitHub Actions: Proto job"] --> B["setup-go"] --> C["Install protoc plugins"] --> D["buf generate"] --> E["goimports"] --> F["git diff check"]
  D -. "avoid remote" .-> X{{"buf.build remote plugins"}}

High-Level Assessment

The following are alternative approaches to this PR:

1. Mirror/host remote plugins internally (BSR or OCI)

➕ Preserves remote-plugin workflow and avoids per-run compilation via go install
➕ Can centralize plugin version management across repos
➖ Adds operational overhead (hosting, auth, lifecycle)
➖ Still introduces a network dependency (just moved to another host)

2. Cache or vendor prebuilt plugin binaries (instead of go install)

➕ Faster CI runs and fully reproducible binaries
➕ Avoids relying on the Go module proxy during CI
➖ More maintenance (OS/arch matrix, updates)
➖ Potentially larger repo/CI complexity vs go install

Recommendation: Current approach (local go/go-grpc plugins + pinned go install in CI) is the best trade-off for reliability and simplicity. It removes the single-point-of-failure (remote plugin host) while keeping versioning explicit and easy to update, and setup-go caching should mitigate repeated installs.

Files changed (2) +13 / -2

Other (2) +13 / -2

ci.ymlInstall pinned Go proto plugins in Proto CI job +9/-0

Install pinned Go proto plugins in Proto CI job

• Adds actions/setup-go to the Proto job and installs pinned protoc-gen-go and protoc-gen-go-grpc before running buf generate. This prevents CI failures caused by buf.build remote plugin host outages and keeps generation deterministic.

.github/workflows/ci.yml

buf.gen.yamlSwitch buf codegen from BSR remote plugins to local go/go-grpc +4/-2

Switch buf codegen from BSR remote plugins to local go/go-grpc

• Replaces buf.build remote plugin references with local go and go-grpc plugins. Adds documentation comments explaining the outage motivation and version alignment expectations.

buf.gen.yaml

qodo-code-review · 2026-07-30T14:09:53Z

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 📜 Skill insights (0)

Context used

✅ Compliance rules (platform): 18 rules

1. ~~Go plugin PATH dependency~~ ✓ Resolved 🐞 Bug ☼ Reliability

Description

buf.gen.yaml now uses local go/go-grpc plugins, so buf generate depends on protoc-gen-go and
protoc-gen-go-grpc being discoverable on PATH at runtime. The workflow installs these binaries but
doesn’t explicitly add the Go bin directory to PATH, so Proto CI becomes dependent on
runner/setup-go PATH behavior and can break if that changes.

Code

buf.gen.yaml[R6-10]

+  - plugin: go
    out: ..
    opt:
      - module=github.com/messagesgoel-blip/verilink
-  - plugin: buf.build/grpc/go:v1.6.2
+  - plugin: go-grpc

Relevance

●●● Strong
CI hardening and explicit pinning/robustness changes are commonly accepted; PATH export is a
low-risk reliability fix.
PR-#8

ⓘ Recommendations generated based on similar findings in past PRs

Evidence

buf.gen.yaml switches to local plugin names (go, go-grpc), which require local plugin
executables. The Proto CI job installs protoc-gen-go/protoc-gen-go-grpc but does not explicitly
export their install dir to PATH before running buf generate, while separately invoking
goimports via an explicit GOPATH/bin path in the same step.

buf.gen.yaml[1-13]
.github/workflows/ci.yml[94-104]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
`buf.gen.yaml` now uses local plugins (`go`, `go-grpc`). Buf resolves these by executing `protoc-gen-go` / `protoc-gen-go-grpc` from `PATH`. The Proto CI job installs these generators but does not explicitly ensure the install directory is on `PATH`, making the job fragile to environment/setup-go PATH changes.

## Issue Context
The workflow already invokes at least one Go-installed tool via an explicit GOPATH/bin path (`goimports`), which suggests the job is not consistently relying on `PATH` for Go tool installs.

## Fix Focus Areas
- .github/workflows/ci.yml[94-104]
- buf.gen.yaml[5-11]

### Suggested fix
In the Proto job, after `setup-go` (or before `buf generate`), explicitly add the Go bin dir to PATH, e.g.:
- `echo "$(go env GOPATH)/bin" >> "$GITHUB_PATH"`

Optionally set `GOBIN` to a known directory and add that directory to `$GITHUB_PATH` to make tool discovery deterministic.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

2. ~~Proto tool versions drift~~ ✓ Resolved 🐞 Bug ⚙ Maintainability

Description

Proto CI now pins protoc-gen-go@v1.36.11 and protoc-gen-go-grpc@v1.6.2, but
scripts/gen-proto.sh still documents installing older versions (v1.34.2/v1.5.1). This creates a
reproducibility footgun where developers following the script may regenerate outputs with generator
versions different from CI’s pinned toolchain.

Code

.github/workflows/ci.yml[R96-98]

+          # Local plugins — do not call buf.build remote plugin hosts.
+          go install google.golang.org/protobuf/cmd/protoc-gen-go@v1.36.11
+          go install google.golang.org/grpc/cmd/protoc-gen-go-grpc@v1.6.2

Relevance

●●● Strong
Team often accepts keeping docs/scripts aligned with CI to avoid reproducibility drift.
PR-#8
PR-#17

ⓘ Recommendations generated based on similar findings in past PRs

Evidence
The PR introduces pinned generator installs in Proto CI. The repo’s generation script still
recommends older pins, while the checked-in generated files already record the newer generator
versions, so following the script is out of sync with CI and current outputs.
.github/workflows/ci.yml[94-101]
scripts/gen-proto.sh[4-11]
pkg/trustpb/trust.pb.go[1-4]
pkg/trustpb/trust_grpc.pb.go[1-4]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
CI pins generator versions for local Buf plugins, but the repo’s `scripts/gen-proto.sh` still documents older generator versions. This makes local regeneration inconsistent with CI and with the committed generated files.

## Issue Context
- CI installs `protoc-gen-go@v1.36.11` and `protoc-gen-go-grpc@v1.6.2`.
- The committed generated files declare they were generated with those versions.
- The generation helper script documents installing older versions.

## Fix Focus Areas
- .github/workflows/ci.yml[94-99]
- scripts/gen-proto.sh[4-11]

### Suggested fix
Update `scripts/gen-proto.sh` to recommend the same pinned versions as CI (v1.36.11 / v1.6.2), or make the script delegate to `buf generate --template ../buf.gen.yaml` after installing those pinned tools, so CI and local workflows share a single source of truth.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

_{To customize comments, go to the Qodo configuration screen, or learn more in the docs.}

Ensure the Go plugin install dir is first on PATH for local buf plugins, and make gen-proto.sh install the same pinned generators as CI. Co-authored-by: Cursor <cursoragent@cursor.com>

messagesgoel-blip · 2026-07-30T15:00:01Z

@coderabbitai review

coderabbitai · 2026-07-30T15:00:07Z

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

fix(ci): generate protos with local plugins

4ce1dbf

Proto CI failed when buf.build remote plugin hosts were unavailable. Use pinned local protoc-gen-go / protoc-gen-go-grpc instead. Co-authored-by: Cursor <cursoragent@cursor.com>

qodo-code-review Bot reviewed Jul 30, 2026

View reviewed changes

Comment thread buf.gen.yaml

Comment thread .github/workflows/ci.yml

fix(ci): pin Proto PATH and align gen-proto.sh versions

4774c17

Ensure the Go plugin install dir is first on PATH for local buf plugins, and make gen-proto.sh install the same pinned generators as CI. Co-authored-by: Cursor <cursoragent@cursor.com>

coderabbitai Bot approved these changes Jul 30, 2026

View reviewed changes

messagesgoel-blip merged commit a9d46e4 into main Jul 30, 2026
5 checks passed

messagesgoel-blip deleted the fix/ci-proto-local-plugins branch July 30, 2026 15:01

Navigation Menu

Uh oh!

fix(ci): Proto generate without buf.build remote plugins - #19

fix(ci): Proto generate without buf.build remote plugins#19
messagesgoel-blip merged 2 commits into
mainfrom
fix/ci-proto-local-plugins

messagesgoel-blip commented Jul 30, 2026

Uh oh!

gemini-code-assist Bot commented Jul 30, 2026

Uh oh!

cursor Bot commented Jul 30, 2026

Uh oh!

coderabbitai Bot commented Jul 30, 2026 •

edited

Loading

Review limit reached

Uh oh!

messagesgoel-blip commented Jul 30, 2026

Uh oh!

coderabbitai Bot commented Jul 30, 2026 •

edited

Loading

Uh oh!

qodo-code-review Bot commented Jul 30, 2026

Uh oh!

qodo-code-review Bot commented Jul 30, 2026 •

edited

Loading

Uh oh!

Uh oh!

Uh oh!

messagesgoel-blip commented Jul 30, 2026

Uh oh!

coderabbitai Bot commented Jul 30, 2026 •

edited

Loading

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

messagesgoel-blip commented Jul 30, 2026

Summary

Test plan

Uh oh!

gemini-code-assist Bot commented Jul 30, 2026

Uh oh!

cursor Bot commented Jul 30, 2026

Uh oh!

coderabbitai Bot commented Jul 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review limit reached

Uh oh!

messagesgoel-blip commented Jul 30, 2026

Uh oh!

coderabbitai Bot commented Jul 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

qodo-code-review Bot commented Jul 30, 2026

PR Summary by Qodo

Uh oh!

qodo-code-review Bot commented Jul 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Code Review by Qodo

Uh oh!

Uh oh!

Uh oh!

messagesgoel-blip commented Jul 30, 2026

Uh oh!

coderabbitai Bot commented Jul 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

coderabbitai Bot commented Jul 30, 2026 •

edited

Loading

coderabbitai Bot commented Jul 30, 2026 •

edited

Loading

qodo-code-review Bot commented Jul 30, 2026 •

edited

Loading

coderabbitai Bot commented Jul 30, 2026 •

edited

Loading