From b8fc558d26180bb12264dc59cbc185a0f6dd03e8 Mon Sep 17 00:00:00 2001
From: Alano Terblanche <18033717+Benehiko@users.noreply.github.com>
Date: Thu, 8 Oct 2026 11:20:15 +0200
Subject: [PATCH] chore(proto): pin protoc-gen-connect-go by commit

buf.gen.yaml used buf.build/connectrpc/go without a version, so every run took the latest plugin from the Buf registry. A newer release generates a different API (no connect.Request wrappers, no IsAtLeastVersion1_13_0 assertion), which made the proto generate check fail on every branch. Remote plugins can only be pinned by version and revision, not by digest, so run protoc-gen-connect-go as a local plugin instead: the proto generate stage installs it with go install at commit ad9598763248cc291416c2e956ecd50d128a19bf (v1.19.1, the connectrpc.com/connect version the modules require), set by CONNECT_GO_COMMIT in the Makefile. This reproduces the committed code exactly.

Signed-off-by: Alano Terblanche <18033717+Benehiko@users.noreply.github.com>
---
 Dockerfile   | 5 +++++
 Makefile     | 4 ++++
 buf.gen.yaml | 3 ++-
 3 files changed, 11 insertions(+), 1 deletion(-)

diff --git a/Dockerfile b/Dockerfile
index 5e432e84..b8705d31 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -197,6 +197,11 @@ RUN --mount=type=bind,target=. \
     buf lint
 
 FROM proto-base AS do-proto-generate
+ARG CONNECT_GO_COMMIT
+RUN --mount=type=cache,target=/root/.cache/go-build \
+    --mount=type=cache,target=/go/pkg/mod \
+    --mount=type=tmpfs,target=/go/src/ \
+    go install "connectrpc.com/connect/cmd/protoc-gen-connect-go@${CONNECT_GO_COMMIT}"
 WORKDIR /src
 RUN mkdir -p /generate/out
 RUN --mount=type=bind,target=.,rw <<EOT
diff --git a/Makefile b/Makefile
index ca238126..9898f00f 100644
--- a/Makefile
+++ b/Makefile
@@ -3,6 +3,9 @@ GO_VERSION := $(shell sh -c "awk '/^go / { print \$$2 }' go.work")
 
 # For latest version, see: https://github.com/bufbuild/buf/tags
 export BUF_VERSION := v1.56.0
+# protoc-gen-connect-go, pinned by commit. Keep in step with connectrpc.com/connect in go.mod.
+# v1.19.1: https://github.com/connectrpc/connect-go/releases/tag/v1.19.1
+export CONNECT_GO_COMMIT := ad9598763248cc291416c2e956ecd50d128a19bf
 
 ifeq ($(OS),Windows_NT)
 	WINDOWS = $(OS)
@@ -25,6 +28,7 @@ BUILDER=buildx-multiarch
 DOCKER_BUILD_ARGS := --build-arg GO_VERSION \
           			--build-arg GOLANGCI_LINT_VERSION \
           			--build-arg BUF_VERSION \
+          			--build-arg CONNECT_GO_COMMIT \
           			--build-arg GIT_TAG
 
 GO_TEST := go test
diff --git a/buf.gen.yaml b/buf.gen.yaml
index 58342593..9156c251 100644
--- a/buf.gen.yaml
+++ b/buf.gen.yaml
@@ -8,7 +8,8 @@ plugins:
     opt:
       - paths=source_relative
       - default_api_level=API_OPAQUE
-  - remote: buf.build/connectrpc/go
+  # Installed in the Dockerfile, pinned by commit via CONNECT_GO_COMMIT in the Makefile.
+  - local: protoc-gen-connect-go
     out: x/api
     opt:
       - paths=source_relative