Remove tools from tools.go (#47)

Remove protoc-gen-doc, afero from tools.go as these pull in
old versions of protobuf leading to ambiguous import errors.

Upgrade protoc-gen-validate for the same reason.

Also add .gitattributes for go.sum management.
And dependabot.yaml to manage actions

Add govulncheck

AB#10624

Signed-off-by: Paul Hewlett <[email protected]>

Author: eccles

.gitattributes

@@ -0,0 +1,2 @@
+**/go.sum              -diff -merge
+**/go.sum              linguist-generated=true

.github/dependabot.yml

@@ -0,0 +1,11 @@
+# refer: https://github.com/dependabot/dependabot-core/blob/main/.github/dependabot.yml
+version: 2
+updates:
+  # Maintain dependencies for GitHub Actions
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+      day: "wednesday"
+      time: "03:00"
+      timezone: "Europe/London"

.github/workflows/ci.yml

@@ -18,7 +18,7 @@ jobs:
       - name: Setup Go
         uses: actions/setup-go@v4
         with:
-          go-version: '1.22.x'
+          go-version: '1.23.x'
           token: ${{ secrets.GITHUB_TOKEN }}
           cache-dependency-path: |
             datatrails-common-api/go.sum
@@ -27,10 +27,19 @@ jobs:
         with:
           version: "24.3"
           repo-token: ${{ secrets.GITHUB_TOKEN }}
+      - name: Setup protoc-gen-doc
+        run: |
+          go install github.com/pseudomuto/protoc-gen-doc/cmd/[email protected]
+
       - name: Generate, Test and Export
         run: |
           task all
 
+      - name: Vulnerability check
+        run: |
+          cd datatrails-common-api
+          go run golang.org/x/vuln/cmd/govulncheck@latest -show verbose ./...
+
       - name: Show exports
         working-directory: exported/
         run: find . -type d

datatrails-common-api/go.mod

@@ -3,54 +3,40 @@ module github.com/datatrails/go-datatrails-common-api-gen
 // Note: the go code is hosted in github.com/datatrails/go-datatrails-common-api-gen
 // hence the module name
 
-go 1.22
+go 1.23.0
 
 // This allows this module to operate as tho it were the generated module. This
 // allows us to manage the proto tool dependencies via this go.mod. This go.mod
 // is also used as the go.mod for the generated package.
 // replace github.com/datatrails/go-datatrails-common-api-gen => ./
 
 require (
-	github.com/datatrails/go-datatrails-common v0.18.1
-	github.com/envoyproxy/protoc-gen-validate v1.0.4
+	github.com/datatrails/go-datatrails-common v0.28.0
+	github.com/envoyproxy/protoc-gen-validate v1.2.1
 	github.com/google/uuid v1.6.0
-	github.com/grpc-ecosystem/grpc-gateway/v2 v2.20.0
-	github.com/lyft/protoc-gen-star/v2 v2.0.3
-	github.com/pseudomuto/protoc-gen-doc v1.5.1
-	github.com/spf13/afero v1.10.0
-	github.com/stretchr/testify v1.9.0
-	go.mongodb.org/mongo-driver v1.12.1
-	google.golang.org/genproto/googleapis/api v0.0.0-20240701130421-f6361c86f094
-	google.golang.org/grpc v1.65.0
+	github.com/grpc-ecosystem/grpc-gateway/v2 v2.23.0
+	github.com/lyft/protoc-gen-star/v2 v2.0.4-0.20230330145011-496ad1ac90a4
+	github.com/stretchr/testify v1.10.0
+	go.mongodb.org/mongo-driver v1.17.3
+	google.golang.org/genproto/googleapis/api v0.0.0-20250106144421-5f5ef82da422
+	google.golang.org/grpc v1.71.1
 	google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.3.0
-	google.golang.org/protobuf v1.34.2
+	google.golang.org/protobuf v1.36.6
 	gopkg.in/yaml.v3 v3.0.1
 )
 
 require (
-	github.com/Masterminds/goutils v1.1.1 // indirect
-	github.com/Masterminds/semver v1.5.0 // indirect
-	github.com/Masterminds/sprig v2.22.0+incompatible // indirect
 	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
-	github.com/gogo/protobuf v1.3.2 // indirect
-	github.com/golang/protobuf v1.5.4 // indirect
-	github.com/huandu/xstrings v1.4.0 // indirect
 	github.com/iancoleman/strcase v0.3.0 // indirect
-	github.com/imdario/mergo v0.3.16 // indirect
-	github.com/mitchellh/copystructure v1.2.0 // indirect
-	github.com/mitchellh/reflectwalk v1.0.2 // indirect
-	github.com/mwitkow/go-proto-validators v0.3.2 // indirect
-	github.com/opentracing/opentracing-go v1.2.0 // indirect
 	github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
-	github.com/pseudomuto/protokit v0.2.1 // indirect
 	github.com/rogpeppe/go-internal v1.6.1 // indirect
+	github.com/spf13/afero v1.10.0 // indirect
 	go.uber.org/multierr v1.11.0 // indirect
 	go.uber.org/zap v1.27.0 // indirect
-	golang.org/x/crypto v0.25.0 // indirect
 	golang.org/x/mod v0.17.0 // indirect
-	golang.org/x/net v0.27.0 // indirect
-	golang.org/x/sys v0.22.0 // indirect
-	golang.org/x/text v0.16.0 // indirect
+	golang.org/x/net v0.34.0 // indirect
+	golang.org/x/sys v0.30.0 // indirect
+	golang.org/x/text v0.22.0 // indirect
 	golang.org/x/tools v0.21.1-0.20240508182429-e35e4ccd0d2d // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20240701130421-f6361c86f094 // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20250115164207-1a7da9e5054f // indirect
 )