proto-lint.yml pins buf via a hand-typed version string Dependabot cannot update

[lklimek]

Summary

Proto linting in CI runs a buf version that no Dependabot ecosystem can see or update. It is pinned as a hand-typed string and will drift further with every go.mod buf bump.

Detail

.github/workflows/proto-lint.yml:16-22:

- uses: actions/checkout@v7
- uses: bufbuild/buf-setup-action@v1.50.0
  with:
    version: "1.59.0"        # <-- line 19
- uses: bufbuild/buf-lint-action@v1
  with:
    input: "proto"

There are three independent buf versions in this repo:

Where	Version	Watched by Dependabot?
go.mod (tools/tools.go)	1.72.0 (as of #1397)	✅ gomod ecosystem
buf-setup-action	@v1.50.0	✅ github-actions ecosystem
version: input (line 19)	1.59.0	❌ nobody

Dependabot's gomod ecosystem parses go.mod; its github-actions ecosystem parses uses: refs. Neither parses a with.version input string. CI's proto-lint gate is therefore frozen at buf 1.59.0 — currently 13 minor releases behind go.mod — and the gap widens with each bump.

This matters beyond staleness: buf lint rules change between releases. v1.72.0, for example, fixes IMPORT_USED silently reporting no unused imports when google/protobuf/descriptor.proto is in the transitive dependency graph. CI is enforcing a different, older ruleset than make lint runs locally.

Suggested fix

Replace both action steps with the same invocation Makefile:138 already uses, so there is one buf version and Dependabot tracks it:

- uses: actions/checkout@v7
- uses: actions/setup-go@v6
  with:
    go-version-file: go.mod
- run: go run github.com/bufbuild/buf/cmd/buf lint
  working-directory: proto

While editing the file, also add an explicit least-privilege token scope, which it currently lacks:

permissions:
  contents: read

Note

bufbuild/buf-lint-action@v1 is a floating major tag, but tag-pinning is repo-wide house style (0 of 67 action references are SHA-pinned), so that is called out for completeness rather than as a defect specific to this workflow. Moot if the steps are replaced as above.

Context

Found while auditing #1397 (bufbuild/buf 1.71.0 → 1.72.0).

_{🤖 Reported by Claudius the Magnificent AI Agent}