Move to OPAQUE (#811)

Fixes #813

Makefile

@@ -43,7 +43,6 @@ install: ## Install all binaries
 .PHONY: lint
 lint: $(BIN)/golangci-lint $(BIN)/buf ## Lint Go and protobuf
 	test -z "$$($(BIN)/buf format -d . | tee /dev/stderr)"
-	$(GO) vet ./...
 	$(BIN)/golangci-lint run
 	$(BIN)/buf format -d --exit-code
 

buf.gen.yaml

@@ -4,4 +4,4 @@ plugins:
     out: private/gen/modules
     opt:
       - paths=source_relative
-      - default_api_level=API_HYBRID
+      - default_api_level=API_OPAQUE

cmd/release/main_test.go

@@ -44,10 +44,10 @@ func TestCalculateNewReleaseModules(t *testing.T) {
 		assertModuleStates(t, map[string]releaseModuleState{
 			"envoyproxy/envoy": {
 				status: modules.New,
-				references: []*statev1alpha1.ModuleReference{{
+				references: []*statev1alpha1.ModuleReference{statev1alpha1.ModuleReference_builder{
 					Name:   "bb554f53ad8d3a2a2ae4cbd7102a3e20ae00b558",
 					Digest: "dummyManifestDigestEnvoy",
-				}},
+				}.Build()},
 			}}, got)
 		assert.True(t, shouldRelease(got))
 	})
@@ -65,10 +65,10 @@ func TestCalculateNewReleaseModules(t *testing.T) {
 		assertModuleStates(t, map[string]releaseModuleState{
 			"envoyproxy/envoy": {
 				status: modules.Updated,
-				references: []*statev1alpha1.ModuleReference{{
+				references: []*statev1alpha1.ModuleReference{statev1alpha1.ModuleReference_builder{
 					Name:   "7850b6bb6494e3bfc093b1aff20282ab30b67940",
 					Digest: "updatedDummyManifestDigestEnvoy",
-				}},
+				}.Build()},
 			}}, got)
 		assert.True(t, shouldRelease(got))
 	})
@@ -109,17 +109,17 @@ func TestCalculateNewReleaseModules(t *testing.T) {
 			},
 			"envoyproxy/envoy": {
 				status: modules.Updated,
-				references: []*statev1alpha1.ModuleReference{{
+				references: []*statev1alpha1.ModuleReference{statev1alpha1.ModuleReference_builder{
 					Name:   "7850b6bb6494e3bfc093b1aff20282ab30b67940",
 					Digest: "updatedDummyManifestDigestEnvoy",
-				}},
+				}.Build()},
 			},
 			"gogo/protobuf": {
 				status: modules.New,
-				references: []*statev1alpha1.ModuleReference{{
+				references: []*statev1alpha1.ModuleReference{statev1alpha1.ModuleReference_builder{
 					Name:   "8892e00f944642b7dc8d81b419879fd4be12f056",
 					Digest: "newDummyManifestDigestGogoProtobuf",
-				}},
+				}.Build()},
 			}}, got)
 		assert.True(t, shouldRelease(got))
 	})
@@ -143,14 +143,14 @@ func TestCalculateNewReleaseModules(t *testing.T) {
 			"envoyproxy/envoy": {
 				status: modules.Updated,
 				references: []*statev1alpha1.ModuleReference{
-					{
+					statev1alpha1.ModuleReference_builder{
 						Name:   "v0.1.0",
 						Digest: "dummyManifestDigestEnvoy",
-					},
-					{
+					}.Build(),
+					statev1alpha1.ModuleReference_builder{
 						Name:   "v0.2.0",
 						Digest: "updatedDummyManifestDigestEnvoy",
-					},
+					}.Build(),
 				},
 			}}, got)
 		assert.True(t, shouldRelease(got))
@@ -177,17 +177,17 @@ func TestCalculateNewReleaseModules(t *testing.T) {
 			},
 			"new/foo": {
 				status: modules.New,
-				references: []*statev1alpha1.ModuleReference{{
+				references: []*statev1alpha1.ModuleReference{statev1alpha1.ModuleReference_builder{
 					Name:   "ref3",
 					Digest: "dummyManifestDigestNewFoo",
-				}},
+				}.Build()},
 			},
 			"new/bar": {
 				status: modules.New,
-				references: []*statev1alpha1.ModuleReference{{
+				references: []*statev1alpha1.ModuleReference{statev1alpha1.ModuleReference_builder{
 					Name:   "ref4",
 					Digest: "dummyManifestDigestNewBar",
-				}},
+				}.Build()},
 			}}, got)
 		assert.True(t, shouldRelease(got))
 	})
@@ -205,17 +205,17 @@ func TestMapGlobalStateReferences(t *testing.T) {
 	t.Run("not_nil_state", func(t *testing.T) {
 		t.Parallel()
 
-		globalState := &statev1alpha1.GlobalState{
+		globalState := statev1alpha1.GlobalState_builder{
 			Modules: []*statev1alpha1.GlobalStateReference{
-				{
+				statev1alpha1.GlobalStateReference_builder{
 					ModuleName:      "test-org/test-repo",
 					LatestReference: "v1.0.0",
-				}, {
+				}.Build(), statev1alpha1.GlobalStateReference_builder{
 					ModuleName:      "other-org/other-repo",
 					LatestReference: "v1.0.0",
-				},
+				}.Build(),
 			},
-		}
+		}.Build()
 		got := mapGlobalStateReferences(globalState)
 		require.Equal(t, map[string]string{
 			"test-org/test-repo":   "v1.0.0",
@@ -232,13 +232,13 @@ func TestCreateReleaseBody(t *testing.T) {
 			"test-org/test-repo": {
 				status: modules.New,
 				references: []*statev1alpha1.ModuleReference{
-					{
+					statev1alpha1.ModuleReference_builder{
 						Name:   "v1.0.0",
 						Digest: "fakedigest",
-					}, {
+					}.Build(), statev1alpha1.ModuleReference_builder{
 						Name:   "v1.1.0",
 						Digest: "fakedigest",
-					},
+					}.Build(),
 				},
 			},
 		}
@@ -267,25 +267,25 @@ func TestCreateReleaseBody(t *testing.T) {
 			"test-org/new-repo": {
 				status: modules.New,
 				references: []*statev1alpha1.ModuleReference{
-					{
+					statev1alpha1.ModuleReference_builder{
 						Name:   "v1.0.0",
 						Digest: "fakedigest",
-					}, {
+					}.Build(), statev1alpha1.ModuleReference_builder{
 						Name:   "v1.1.0",
 						Digest: "fakedigest",
-					},
+					}.Build(),
 				},
 			},
 			"test-org/updated-repo": {
 				status: modules.Updated,
 				references: []*statev1alpha1.ModuleReference{
-					{
+					statev1alpha1.ModuleReference_builder{
 						Name:   "v1.0.0",
 						Digest: "fakedigest",
-					}, {
+					}.Build(), statev1alpha1.ModuleReference_builder{
 						Name:   "v1.1.0",
 						Digest: "fakedigest",
-					},
+					}.Build(),
 				},
 			},
 		}
@@ -341,7 +341,7 @@ func TestCreateReleaseBody(t *testing.T) {
 			//nolint:exhaustive // other module states should not have any reference
 			switch state {
 			case modules.New, modules.Updated:
-				references = []*statev1alpha1.ModuleReference{{Name: "v1.0.0", Digest: "fakedigest"}}
+				references = []*statev1alpha1.ModuleReference{statev1alpha1.ModuleReference_builder{Name: "v1.0.0", Digest: "fakedigest"}.Build()}
 			}
 			// map order is not guaranteed
 			mods[modName] = releaseModuleState{
@@ -437,10 +437,10 @@ func TestWriteReferencesTable(t *testing.T) {
 	populateReferences := func(refsCount int) []*statev1alpha1.ModuleReference {
 		refs := make([]*statev1alpha1.ModuleReference, refsCount)
 		for i := range refsCount {
-			refs[i] = &statev1alpha1.ModuleReference{
+			refs[i] = statev1alpha1.ModuleReference_builder{
 				Name:   fmt.Sprintf("commit%03d", i),
 				Digest: fmt.Sprintf("digest%03d", i),
-			}
+			}.Build()
 		}
 		return refs
 	}

go.mod

@@ -17,8 +17,10 @@ require (
 )
 
 require (
+	buf.build/go/protoyaml v0.3.1 // indirect
 	cel.dev/expr v0.19.1 // indirect
 	github.com/antlr4-go/antlr/v4 v4.13.1 // indirect
+	github.com/bufbuild/protocompile v0.14.1 // indirect
 	github.com/davecgh/go-spew v1.1.1 // indirect
 	github.com/google/cel-go v0.22.1 // indirect
 	github.com/google/go-querystring v1.1.0 // indirect
@@ -27,6 +29,7 @@ require (
 	github.com/stoewer/go-strcase v1.3.0 // indirect
 	golang.org/x/crypto v0.31.0 // indirect
 	golang.org/x/exp v0.0.0-20250103183323-7d7fa50e5329 // indirect
+	golang.org/x/sync v0.10.0 // indirect
 	golang.org/x/sys v0.29.0 // indirect
 	golang.org/x/text v0.21.0 // indirect
 	google.golang.org/genproto/googleapis/api v0.0.0-20250102185135-69823020774d // indirect

go.sum

@@ -1,11 +1,15 @@
 buf.build/gen/go/bufbuild/protovalidate/protocolbuffers/go v1.36.2-20241127180247-a33202765966.1 h1:BICM6du/XzvEgeorNo4xgohK3nMTmEPViGyd5t7xVqk=
 buf.build/gen/go/bufbuild/protovalidate/protocolbuffers/go v1.36.2-20241127180247-a33202765966.1/go.mod h1:JnMVLi3qrNYPODVpEKG7UjHLl/d2zR221e66YCSmP2Q=
+buf.build/go/protoyaml v0.3.1 h1:ucyzE7DRnjX+mQ6AH4JzN0Kg50ByHHu+yrSKbgQn2D4=
+buf.build/go/protoyaml v0.3.1/go.mod h1:0TzNpFQDXhwbkXb/ajLvxIijqbve+vMQvWY/b3/Dzxg=
 cel.dev/expr v0.19.1 h1:NciYrtDRIR0lNCnH1LFJegdjspNx9fI59O7TWcua/W4=
 cel.dev/expr v0.19.1/go.mod h1:MrpN08Q+lEBs+bGYdLxxHkZoUSsCp0nSKTs0nTymJgw=
 github.com/antlr4-go/antlr/v4 v4.13.1 h1:SqQKkuVZ+zWkMMNkjy5FZe5mr5WURWnlpmOuzYWrPrQ=
 github.com/antlr4-go/antlr/v4 v4.13.1/go.mod h1:GKmUxMtwp6ZgGwZSva4eWPC5mS6vUAmOABFgjdkM7Nw=
 github.com/bufbuild/buf v1.49.0 h1:KFSyea50xgvfnqGfK7Z4UCPTYhoCoUYAK2IoRd8/oUA=
 github.com/bufbuild/buf v1.49.0/go.mod h1:PssF/YByu7WU6K3FxRmoRxi4ZViugL7rjAaoVvxknso=
+github.com/bufbuild/protocompile v0.14.1 h1:iA73zAf/fyljNjQKwYzUHD6AD4R8KMasmwa/FBatYVw=
+github.com/bufbuild/protocompile v0.14.1/go.mod h1:ppVdAIhbr2H8asPk6k4pY7t9zB1OU5DoEw9xY/FUi1c=
 github.com/bufbuild/protovalidate-go v0.8.2 h1:sgzXHkHYP6HnAsL2Rd3I1JxkYUyEQUv9awU1PduMxbM=
 github.com/bufbuild/protovalidate-go v0.8.2/go.mod h1:K6w8iPNAXBoIivVueSELbUeUl+MmeTQfCDSug85pn3M=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
@@ -64,6 +68,8 @@ golang.org/x/mod v0.22.0 h1:D4nJWe9zXqHOmWqj4VMOJhvzj7bEZg4wEYa759z1pH4=
 golang.org/x/mod v0.22.0/go.mod h1:6SkKJ3Xj0I0BrPOZoBy3bdMptDDU9oJrpohJ3eWZ1fY=
 golang.org/x/oauth2 v0.25.0 h1:CY4y7XT9v0cRI9oupztF8AgiIu99L/ksR/Xp/6jrZ70=
 golang.org/x/oauth2 v0.25.0/go.mod h1:XYTD2NtWslqkgxebSiOHnXEap4TF09sJSc7H1sXbhtI=
+golang.org/x/sync v0.10.0 h1:3NQrjDixjgGwUOCaF8w2+VYHv0Ve/vGYSbdkTa98gmQ=
+golang.org/x/sync v0.10.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
 golang.org/x/sys v0.29.0 h1:TPYlXGxvx1MGTn2GiZDhnjPA9wZzZeGKHHmKhHYvgaU=
 golang.org/x/sys v0.29.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/text v0.21.0 h1:zyQAAkrwaneQ066sspRyJaG9VNi/YJ1NfzcGB3hZ/qo=

internal/githubutil/githubutil.go

@@ -16,7 +16,6 @@ package githubutil
 
 import (
 	"context"
-	"encoding/json"
 	"errors"
 	"fmt"
 	"io"
@@ -26,6 +25,7 @@ import (
 	"strings"
 	"time"
 
+	"github.com/bufbuild/buf/private/pkg/protoencoding"
 	"github.com/bufbuild/modules/private/bufpkg/bufstate"
 	statev1alpha1 "github.com/bufbuild/modules/private/gen/modules/state/v1alpha1"
 	"github.com/google/go-github/v64/github"
@@ -191,15 +191,15 @@ func (c *Client) DownloadReleaseState(
 	ctx context.Context,
 	release *github.RepositoryRelease,
 ) (*statev1alpha1.GlobalState, error) {
-	manifestBytes, _, err := c.downloadAsset(ctx, release, bufstate.ModStateFileName)
+	data, _, err := c.downloadAsset(ctx, release, bufstate.ModStateFileName)
 	if err != nil {
 		return nil, err
 	}
-	var moduleReleases statev1alpha1.GlobalState
-	if err := json.Unmarshal(manifestBytes, &moduleReleases); err != nil {
+	var globalState statev1alpha1.GlobalState
+	if err := protoencoding.NewJSONUnmarshaler(protoencoding.EmptyResolver).Unmarshal(data, &globalState); err != nil {
 		return nil, err
 	}
-	return &moduleReleases, nil
+	return &globalState, nil
 }
 
 // downloadAsset uses the GitHub API to download the asset with the given name from the release.

private/bufpkg/bufstate/global_state.go

@@ -15,11 +15,11 @@
 package bufstate
 
 import (
-	"encoding/json"
 	"fmt"
 	"io"
 	"sort"
 
+	"github.com/bufbuild/buf/private/pkg/protoencoding"
 	statev1alpha1 "github.com/bufbuild/modules/private/gen/modules/state/v1alpha1"
 	"go.uber.org/multierr"
 )
@@ -33,12 +33,16 @@ func (rw *ReadWriter) ReadGlobalState(reader io.ReadCloser) (_ *statev1alpha1.Gl
 			retErr = multierr.Append(retErr, fmt.Errorf("close file: %w", err))
 		}
 	}()
+	bytes, err := io.ReadAll(reader)
+	if err != nil {
+		return nil, fmt.Errorf("read global state file: %w", err)
+	}
 	var globalState statev1alpha1.GlobalState
-	if err := json.NewDecoder(reader).Decode(&globalState); err != nil {
-		return nil, fmt.Errorf("read file: %w", err)
+	if err := protoencoding.NewJSONUnmarshaler(protoencoding.EmptyResolver).Unmarshal(bytes, &globalState); err != nil {
+		return nil, fmt.Errorf("unmarshal global state: %w", err)
 	}
 	if err := rw.validator.Validate(&globalState); err != nil {
-		return nil, fmt.Errorf("validate: %w", err)
+		return nil, fmt.Errorf("validate global state: %w", err)
 	}
 	return &globalState, nil
 }
@@ -57,10 +61,14 @@ func (rw *ReadWriter) WriteGlobalState(writer io.WriteCloser, globalState *state
 	sort.Slice(mods, func(i, j int) bool {
 		return mods[i].GetModuleName() < mods[j].GetModuleName()
 	})
-	globalState.Modules = mods
-	data, err := json.MarshalIndent(globalState, "", "  ")
+	globalState.SetModules(mods)
+	data, err := protoencoding.NewJSONMarshaler(
+		protoencoding.EmptyResolver,
+		protoencoding.JSONMarshalerWithUseProtoNames(),
+		protoencoding.JSONMarshalerWithIndent(),
+	).Marshal(globalState)
 	if err != nil {
-		return fmt.Errorf("json marshal state: %w", err)
+		return fmt.Errorf("marshal global state: %w", err)
 	}
 	if _, err := writer.Write(data); err != nil {
 		return fmt.Errorf("write to file: %w", err)