chore: enforce codegen plugin versions match go.mod

magefiles/depsync.go

@@ -0,0 +1,83 @@
+//go:build mage
+
+package main
+
+import (
+	"fmt"
+	"os"
+	"strings"
+
+	"golang.org/x/mod/modfile"
+)
+
+// codegenModules lists the modules that provide both a codegen plugin (run
+// from the magefiles module via `go run`; see magefiles/buf.gen.yaml) and the
+// runtime library that the generated code links against (a dependency of the
+// root module). Their versions must match so that generated code and runtime
+// agree; keep this list in sync with magefiles/buf.gen.yaml.
+//
+// protoc-gen-go-grpc is intentionally absent: it lives in its own module
+// (google.golang.org/grpc/cmd/protoc-gen-go-grpc) with a version series
+// unrelated to the google.golang.org/grpc runtime, so there is nothing to
+// compare.
+var codegenModules = []string{
+	"google.golang.org/protobuf",
+	"github.com/grpc-ecosystem/grpc-gateway/v2",
+	"github.com/planetscale/vtprotobuf",
+	"github.com/envoyproxy/protoc-gen-validate",
+}
+
+// Depsync checks that codegen plugin versions in magefiles/go.mod match go.mod
+func (Lint) Depsync() error {
+	fmt.Println("checking codegen plugin versions against go.mod")
+
+	rootVersions, err := moduleVersions("go.mod")
+	if err != nil {
+		return err
+	}
+	mageVersions, err := moduleVersions("magefiles/go.mod")
+	if err != nil {
+		return err
+	}
+
+	var mismatches []string
+	for _, mod := range codegenModules {
+		rootVersion, inRoot := rootVersions[mod]
+		mageVersion, inMage := mageVersions[mod]
+		if !inRoot || !inMage {
+			// The module is no longer used by one of the go.mod files;
+			// this list and magefiles/buf.gen.yaml likely need updating.
+			continue
+		}
+		if rootVersion != mageVersion {
+			mismatches = append(mismatches, fmt.Sprintf(
+				"%s: go.mod has %s but magefiles/go.mod has %s",
+				mod, rootVersion, mageVersion))
+		}
+	}
+
+	if len(mismatches) > 0 {
+		return fmt.Errorf(
+			"codegen plugin versions are out of sync with go.mod:\n\t%s\n"+
+				"align them (e.g. `go get -C magefiles <module>@<version>`), then run `mage deps:tidy` and `mage gen:proto`",
+			strings.Join(mismatches, "\n\t"))
+	}
+	return nil
+}
+
+func moduleVersions(path string) (map[string]string, error) {
+	data, err := os.ReadFile(path)
+	if err != nil {
+		return nil, fmt.Errorf("failed to read %s: %w", path, err)
+	}
+	file, err := modfile.Parse(path, data, nil)
+	if err != nil {
+		return nil, fmt.Errorf("failed to parse %s: %w", path, err)
+	}
+
+	versions := make(map[string]string, len(file.Require))
+	for _, req := range file.Require {
+		versions[req.Mod.Path] = req.Mod.Version
+	}
+	return versions, nil
+}

magefiles/go.mod

@@ -2,7 +2,10 @@ module github.com/authzed/authzed-go/magefiles
 
 go 1.25.6
 
-require github.com/magefile/mage v1.17.0
+require (
+	github.com/magefile/mage v1.17.0
+	golang.org/x/mod v0.34.0
+)
 
 require (
 	4d63.com/gocheckcompilerdirectives v1.3.0 // indirect
@@ -136,7 +139,7 @@ require (
 	github.com/gostaticanalysis/comment v1.5.0 // indirect
 	github.com/gostaticanalysis/forcetypeassert v0.2.0 // indirect
 	github.com/gostaticanalysis/nilerr v0.1.2 // indirect
-	github.com/grpc-ecosystem/grpc-gateway/v2 v2.28.0 // indirect
+	github.com/grpc-ecosystem/grpc-gateway/v2 v2.29.0 // indirect
 	github.com/hashicorp/go-immutable-radix/v2 v2.1.0 // indirect
 	github.com/hashicorp/go-version v1.8.0 // indirect
 	github.com/hashicorp/golang-lru/v2 v2.0.7 // indirect
@@ -275,18 +278,17 @@ require (
 	golang.org/x/crypto v0.49.0 // indirect
 	golang.org/x/exp v0.0.0-20260218203240-3dfff04db8fa // indirect
 	golang.org/x/exp/typeparams v0.0.0-20260209203927-2842357ff358 // indirect
-	golang.org/x/mod v0.34.0 // indirect
 	golang.org/x/net v0.52.0 // indirect
 	golang.org/x/sync v0.20.0 // indirect
 	golang.org/x/sys v0.42.0 // indirect
 	golang.org/x/telemetry v0.0.0-20260311193753-579e4da9a98c // indirect
 	golang.org/x/term v0.41.0 // indirect
-	golang.org/x/text v0.35.0 // indirect
+	golang.org/x/text v0.36.0 // indirect
 	golang.org/x/tools v0.43.0 // indirect
 	golang.org/x/vuln v1.1.4 // indirect
-	google.golang.org/genproto/googleapis/api v0.0.0-20260226221140-a57be14db171 // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20260226221140-a57be14db171 // indirect
-	google.golang.org/grpc v1.79.1 // indirect
+	google.golang.org/genproto/googleapis/api v0.0.0-20260414002931-afd174a4e478 // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20260414002931-afd174a4e478 // indirect
+	google.golang.org/grpc v1.80.0 // indirect
 	google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.6.1 // indirect
 	google.golang.org/protobuf v1.36.11 // indirect
 	gopkg.in/ini.v1 v1.67.0 // indirect

magefiles/lint.go

@@ -22,7 +22,7 @@ func (l Lint) All() error {
 
 // Extra lits everything that's not code
 func (l Lint) Extra() error {
-	mg.Deps(l.Yaml)
+	mg.Deps(l.Yaml, l.Depsync)
 	return nil
 }