chore: modernize and harden codegen toolchain

.gitattributes

@@ -0,0 +1,9 @@
+# SPDX-FileCopyrightText: 2024 P4 API Working Group
+# SPDX-License-Identifier: Apache-2.0
+
+*.go text eol=lf
+*.mod text eol=lf
+*.py text eol=lf
+*.sh text eol=lf
+*.sum text eol=lf
+*.toml text eol=lf

.github/workflows/codegen.yml

@@ -16,13 +16,13 @@ on:
 
 jobs:
   check-codegen:
-    runs-on: [ubuntu-latest]
+    runs-on: ubuntu-22.04
     steps:
-    - uses: actions/checkout@v3
-    - name: Compile protobufs
-      run: |
-        docker build -t p4runtime-ci -f codegen/Dockerfile .
-        docker run -t p4runtime-ci /p4runtime/codegen/compile_protos.sh /tmp
-    - name: Check codegen
-      run: |
-        ./CI/check_codegen.sh
+      - uses: actions/checkout@v4
+      - name: Compile protobufs
+        run: |
+          docker build -t p4runtime-ci -f codegen/Dockerfile .
+          docker run --rm -t p4runtime-ci /p4runtime/codegen/compile_protos.sh /tmp
+      - name: Check codegen
+        run: |
+          ./CI/check_codegen.sh

CI/check_codegen.sh

@@ -26,20 +26,29 @@ rm -rf go/*
 rm -rf py/p4
 ./codegen/update.sh
 
-diff="$(git status --porcelain go go.mod go.sum)"
-
-if [ ! -z "$diff" ]; then
-    echo "The generated Go files are not up-to-date"
-    echo "You can regenerate them with './codegen/update.sh' and commit the changes"
+go_diff="$(git diff --name-only go/ go.mod go.sum)"
+
+# Ensure generated Go files are up-to-date
+if [ -n "$go_diff" ]; then
+    echo "ERROR: The generated Go files are not up-to-date."
+    echo "Run './codegen/update.sh' locally and commit the result."
+    echo ""
+    echo "Diff:"
+    echo "$go_diff"
     exit 1
 fi
 
-diff="$(git status --porcelain py)"
+py_diff="$(git diff --name-only py/)"
 
-if [ ! -z "$diff" ]; then
-    echo "The generated Python files are not up-to-date"
-    echo "You can regenerate them with './codegen/update.sh' and commit the changes"
+if [ -n "$py_diff" ]; then
+    echo "ERROR: The generated Python files are not up-to-date."
+    echo "Run './codegen/update.sh' locally and commit the result."
+    echo ""
+    echo "Diff:"
+    echo "$py_diff"
     exit 1
 fi
 
+echo "Codegen check passed: all generated files are up-to-date."
+
 popd >/dev/null

codegen/Dockerfile

@@ -14,33 +14,54 @@
 #
 # SPDX-License-Identifier: Apache-2.0
 
-FROM p4lang/third-party:latest
+# Pin the base image to a specific digest so that codegen output is
+# reproducible across machines and CI runs.  To update, pull the new
+# image, run `docker inspect --format='{{index .RepoDigests 0}}'
+# p4lang/third-party:latest`, and replace the digest below.
+FROM p4lang/third-party@sha256:e9ea666a19d5ab51520ffe40e4c06ee5b8407f80e4ec1a4ae9501f21687255c1
+
 LABEL maintainer="P4 API Working Group <p4-dev@lists.p4.org>"
 LABEL description="Dockerfile used for CI testing of p4lang/p4runtime"
 
 # No questions asked during package installation.
 ARG DEBIAN_FRONTEND=noninteractive
 
 RUN apt-get update && \
-    apt-get install -y --no-install-recommends software-properties-common git curl
+    apt-get install -y --no-install-recommends \
+        software-properties-common \
+        git \
+        curl && \
+    rm -rf /var/lib/apt/lists/*
 
-ARG GO_VERSION=1.20.5
+# Go toolchain — bump this arg (and re-verify the SHA-256 below) when
+# upgrading.  SHA-256 values are taken directly from https://go.dev/dl/
+# and must be updated together with GO_VERSION.
+ARG GO_VERSION=1.25.11
 
 RUN set -eux; \
     dpkgArch="$(dpkg --print-architecture)"; \
     case "${dpkgArch##*-}" in \
-         amd64) arch='amd64' ;; \
-	 arm64) arch='arm64' ;; \
+         amd64) arch='amd64'; \
+                goSHA256='34f14304e856893f4ba30c2cacfe93906e9de7915c5f6aaaf3a81cdccd7ba30b' ;; \
+         arm64) arch='arm64'; \
+                goSHA256='c30bf9e156a54ea4e31fbbbf31a712b32734b58cc9a22426fa5ee632d0885124' ;; \
          *) arch=''; echo >&2; echo >&2 "unsupported architecture '$dpkgArch'"; echo >&2 ; exit 1 ;; \
     esac; \
-    curl -L -o go.tar.gz https://dl.google.com/go/go${GO_VERSION}.linux-${arch}.tar.gz; \
+    curl -fsSL -o go.tar.gz "https://dl.google.com/go/go${GO_VERSION}.linux-${arch}.tar.gz"; \
+    echo "${goSHA256}  go.tar.gz" | sha256sum -c -; \
     tar -C /usr/local -xzf go.tar.gz; \
     rm -f go.tar.gz
 
 ENV PATH="${PATH}:/usr/local/go/bin:/root/go/bin"
 
-RUN go install google.golang.org/protobuf/cmd/protoc-gen-go@v1.31
-RUN go install google.golang.org/grpc/cmd/protoc-gen-go-grpc@v1.3
+# Pin protoc plugin versions explicitly.  These must stay in sync with
+# the versions recorded in the generated file headers under go/.  When
+# bumping either plugin, regenerate the Go outputs and commit them.
+ARG PROTOC_GEN_GO_VERSION=v1.34.2
+ARG PROTOC_GEN_GO_GRPC_VERSION=v1.5.1
+
+RUN go install "google.golang.org/protobuf/cmd/protoc-gen-go@${PROTOC_GEN_GO_VERSION}"
+RUN go install "google.golang.org/grpc/cmd/protoc-gen-go-grpc@${PROTOC_GEN_GO_GRPC_VERSION}"
 
 COPY . /p4runtime/
 WORKDIR /p4runtime/

codegen/update.sh

@@ -42,12 +42,14 @@ docker run --rm \
        -v "$tmpdir:/tmp/gen" \
        p4runtime-ci bash -c "rm -r /tmp/gen/*"
 
+# Keep go mod tidy pinned to the same Go version declared in go.mod so
+# that the toolchain directive stays stable across developer machines.
 docker run --rm -u "$(id -u):$(id -g)" \
        -e "GOCACHE=/tmp/gocache" \
        -e "GOPATH=/tmp/gopath" \
        -v "$(pwd):/p4runtime" \
        -w /p4runtime \
-       golang:1.20 bash -c "go mod tidy"
+       golang:1.25.11 bash -c "go mod tidy"
 
 rm -rf "$tmpdir"
 

go.mod

@@ -1,15 +1,14 @@
 module github.com/p4lang/p4runtime
 
-go 1.20
+go 1.25
 
 require (
-	google.golang.org/genproto v0.0.0-20230410155749-daa745c078e1
-	google.golang.org/grpc v1.56.3
-	google.golang.org/protobuf v1.33.0
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20240730163845-b1a4ccb954bf
+	google.golang.org/grpc v1.65.0
+	google.golang.org/protobuf v1.34.2
 )
 
 require (
-	github.com/golang/protobuf v1.5.3 // indirect
 	golang.org/x/net v0.38.0 // indirect
 	golang.org/x/sys v0.31.0 // indirect
 	golang.org/x/text v0.23.0 // indirect

go.sum

@@ -1,20 +1,14 @@
-github.com/golang/protobuf v1.5.0/go.mod h1:FsONVRAS9T7sI+LIUmWTfcYkHO4aIWwzhcaSAoJOfIk=
-github.com/golang/protobuf v1.5.3 h1:KhyjKVUg7Usr/dYsdSqoFveMYd5ko72D+zANwlG1mmg=
-github.com/golang/protobuf v1.5.3/go.mod h1:XVQd3VNwM+JqD3oG2Ue2ip4fOMUkwXdXDdiuN0vRsmY=
-github.com/google/go-cmp v0.5.5/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
-github.com/google/go-cmp v0.5.9 h1:O2Tfq5qg4qc4AmwVlvv0oLiVAGB7enBSJ2x2DqQFi38=
+github.com/google/go-cmp v0.6.0 h1:ofyhxvXcZhMsU5ulbFiLKl/XBFqE1GSq7atu8tAmTRI=
+github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
 golang.org/x/net v0.38.0 h1:vRMAPTMaeGqVhG5QyLJHqNDwecKTomGeqbnfZyKlBI8=
 golang.org/x/net v0.38.0/go.mod h1:ivrbrMbzFq5J41QOQh0siUuly180yBYtLp+CKbEaFx8=
 golang.org/x/sys v0.31.0 h1:ioabZlmFYtWhL+TRYpcnNlLwhyxaM9kWTDEmfnprqik=
 golang.org/x/sys v0.31.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k=
 golang.org/x/text v0.23.0 h1:D71I7dUrlY+VX0gQShAThNGHFxZ13dGLBHQLVl1mJlY=
 golang.org/x/text v0.23.0/go.mod h1:/BLNzu4aZCJ1+kcD0DNRotWKage4q2rGVAg4o22unh4=
-golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
-google.golang.org/genproto v0.0.0-20230410155749-daa745c078e1 h1:KpwkzHKEF7B9Zxg18WzOa7djJ+Ha5DzthMyZYQfEn2A=
-google.golang.org/genproto v0.0.0-20230410155749-daa745c078e1/go.mod h1:nKE/iIaLqn2bQwXBg8f1g2Ylh6r5MN5CmZvuzZCgsCU=
-google.golang.org/grpc v1.56.3 h1:8I4C0Yq1EjstUzUJzpcRVbuYA2mODtEmpWiQoN/b2nc=
-google.golang.org/grpc v1.56.3/go.mod h1:I9bI3vqKfayGqPUAwGdOSu7kt6oIJLixfffKrpXqQ9s=
-google.golang.org/protobuf v1.26.0-rc.1/go.mod h1:jlhhOSvTdKEhbULTjvd4ARK9grFBp09yW+WbY/TyQbw=
-google.golang.org/protobuf v1.26.0/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc=
-google.golang.org/protobuf v1.33.0 h1:uNO2rsAINq/JlFpSdYEKIZ0uKD/R9cpdv0T+yoGwGmI=
-google.golang.org/protobuf v1.33.0/go.mod h1:c6P6GXX6sHbq/GpV6MGZEdwhWPcYBgnhAHhKbcUYpos=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20240730163845-b1a4ccb954bf h1:liao9UHurZLtiEwBgT9LMOnKYsHze6eA6w1KQCMVN2Q=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20240730163845-b1a4ccb954bf/go.mod h1:Ue6ibwXGpU+dqIcODieyLOcgj7z8+IcskoNIgZxtrFY=
+google.golang.org/grpc v1.65.0 h1:bs/cUb4lp1G5iImFFd3u5ixQzweKizoZJAwBNLR42lc=
+google.golang.org/grpc v1.65.0/go.mod h1:WgYC2ypjlB0EiQi6wdKixMqukr6lBc0Vo+oOgjrM5ZQ=
+google.golang.org/protobuf v1.34.2 h1:6xV6lTsCfpGD21XK49h7MhtcApnLqkfYgPcdHftf6hg=
+google.golang.org/protobuf v1.34.2/go.mod h1:qYOHts0dSfpeUzUFpOMr/WGzszTmLH+DiWniOlNbLDw=