Streamline Dev Dependencies

[kalverra]

Summary

Centralizes dev-tool version pinning behind two manifest files and a Go CLI (tools/toolversion). Replaces scattered hardcoded pins in the Makefile, CI, scripts, and Docker with manifest lookups, and adds a drift checker so version bumps happen in one place.

Why

Dev-tool versions were drifting across GNUmakefile, nested .tool-versions files, CI actions, and shell scripts (e.g. golangci-lint 2.11.4 in CI vs 2.12.2 in .tool-versions, gotestsum 1.12.3 vs 1.13.0).

What changed

• New Go CLI at tools/toolversion/ — reads manifests, installs tools, checks drift
• Two manifests remain the only human-edited pin sources:
  • .tool-versions — mise/asdf runtimes (go, node, mockery, protoc, golangci-lint, …)
  • tools/go-tools.txt — pure go install CLIs (gomods, gotestsum, delve, …)
• Consumers migrated — Makefile, CI workflows, composite actions, test scripts, Dockerfiles now call go run ./tools/toolversion instead of hardcoding @vX.Y.Z
• Nested .tool-versions removed — integration-tests and cre/environment copies merged into root
• Bash scripts deleted — tools/bin/tool-version, check-tool-versions, tool-version_test.sh
• CI — make test-tool-versions + make check-tool-versions in the generate/clean job

How it works

Bump a version: edit one line in the right manifest, run make check-tool-versions.

Tool type	Edit	Example
Runtime with mise/asdf plugin	.tool-versions	mockery 2.53.0
go install CLI, no plugin	tools/go-tools.txt	gotest.tools/gotestsum 1.13.0

Install tools (any dev, no version manager required):

make install-dev-tools    # mockery, gomods, modgraph, codecgen, gencodec + protoc plugins

With mise/asdf: mise install / asdf install for runtimes, then make install-dev-tools for Go CLIs.

Makefile / CI read versions at runtime:

go run ./tools/toolversion get mockery           # → 2.53.0
go run ./tools/toolversion ref golangci-lint     # → v2.12.2
go run ./tools/toolversion go-install mockery    # → go install github.com/vektra/mockery/v2@v2.53.0

Drift guard (toolversion check):

• No hardcoded go install …@pin in tracked source (Makefile, workflows, scripts, …)
• Root .tool-versions golang matches root go.mod go directive
• Only one .tool-versions (repo root)
• Documented exceptions in tools/version-exceptions.yaml (protoc plugins coupled to go.mod)

Intentional exceptions

• go.mod go directive — authoritative for the module toolchain; .tool-versions golang mirrors it
• protoc-gen-go / protoc-gen-go-wsrpc — version tracks go.mod deps, not manifests
• shell.nix — separate Nix ecosystem, out of scope

[github-actions]

✅ No conflicts with other open PRs targeting develop

[trunk-io]

     

View Full Report ↗︎ ⋅ Docs

[github-actions]

I see you updated files related to core. Please run make gocs in the root directory to add a changeset as well as in the text include at least one of the following tags:

• #added For any new functionality added.
• #breaking_change For any functionality that requires manual action for the node to boot.
• #bugfix For bug fixes.
• #changed For any change to the existing functionality.
• #db_update For any feature that introduces updates to database schema.
• #deprecation_notice For any upcoming deprecation functionality.
• #internal For changesets that need to be excluded from the final changelog.
• #nops For any feature that is NOP facing and needs to be in the official Release Notes for the release.
• #removed For any functionality/config that is removed.
• #updated For any functionality that is updated.
• #wip For any change that is not ready yet and external communication about it should be held off till it is feature complete.

[cl-sonarqube-production]

Quality Gate passed

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
No data about Coverage
0.0% Duplication on New Code

See analysis details on SonarQube