generate protobuf with buf instead of protoc

.github/workflows/build.yml

@@ -7,11 +7,6 @@ on:
     branches: [ "**" ]
   workflow_dispatch:
 
-env:
-  GO_VER: 1.26.3
-  PROTOC_VER: "36.2"
-  PROTOC_GEN_GO_VER: v1.36.12
-
 jobs:
   validate:
     runs-on: ubuntu-latest
@@ -22,15 +17,7 @@ jobs:
       - name: Install Go
         uses: actions/setup-go@v7
         with:
-          go-version: ${{ env.GO_VER }}
-
-      - name: Install Protoc
-        run: |
-          curl -fL --retry 3 -o /tmp/protoc.zip "https://github.com/protocolbuffers/protobuf/releases/download/v${{ env.PROTOC_VER }}/protoc-${{ env.PROTOC_VER }}-linux-x86_64.zip"
-          # update this hash whenever PROTOC_VER is bumped
-          echo "121f6c7afe1d4d0e3ea6aab9432038599250134cbf4474cb1167d2c7decd4278  /tmp/protoc.zip" | sha256sum -c -
-          unzip -o /tmp/protoc.zip -d "$HOME/protoc" 'bin/*' 'include/*'
-          echo "$HOME/protoc/bin" >> "$GITHUB_PATH"
+          go-version-file: go.mod
 
       - name: check go.mod
         run: |
@@ -55,10 +42,8 @@ jobs:
 
       - name: check protobuf
         run: |
-          go install google.golang.org/protobuf/cmd/protoc-gen-go@${{ env.PROTOC_GEN_GO_VER }}
-          protoc --go_opt=paths=source_relative --go_out=. smartbftprotos/*.proto
-          protoc --go_opt=paths=source_relative --go_out=. examples/naive_chain/*.proto
-          protoc --go_opt=paths=source_relative --go_out=. test/*.proto
+          go -C tools install github.com/bufbuild/buf/cmd/buf google.golang.org/protobuf/cmd/protoc-gen-go
+          PATH="$(go env GOPATH)/bin:$PATH" buf generate
           git diff --exit-code
 
   build:
@@ -72,7 +57,7 @@ jobs:
     - name: Install Go
       uses: actions/setup-go@v7
       with:
-        go-version: ${{ env.GO_VER }}
+        go-version-file: go.mod
 
     - name: Test
       run: |

.github/workflows/vulnerability-scan.yml

@@ -23,6 +23,15 @@ jobs:
   scan-scheduled:
     if: ${{ github.event_name == 'push' || github.event_name == 'schedule' || github.event_name == 'workflow_dispatch' }}
     uses: "google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml@v2.7.0"
+    with:
+      # scan the main module only; tools/go.mod is the build-time tooling
+      scan-args: |-
+        -L
+        go.mod
   scan-pr:
     if: ${{ github.event_name == 'pull_request' || github.event_name == 'merge_group' }}
     uses: "google/osv-scanner-action/.github/workflows/osv-scanner-reusable-pr.yml@v2.7.0"
+    with:
+      scan-args: |-
+        -L
+        go.mod

buf.gen.yaml

@@ -0,0 +1,5 @@
+version: v2
+plugins:
+  - local: protoc-gen-go
+    out: .
+    opt: paths=source_relative

buf.yaml

@@ -0,0 +1,3 @@
+version: v2
+modules:
+  - path: .

go.mod

@@ -1,6 +1,6 @@
 module github.com/hyperledger/SmartBFT
 
-go 1.26.3
+go 1.26.7
 
 require (
 	github.com/stretchr/testify v1.12.1

tools/go.mod

@@ -0,0 +1,100 @@
+module github.com/hyperledger/SmartBFT/tools
+
+go 1.26.7
+
+tool (
+	github.com/bufbuild/buf/cmd/buf
+	google.golang.org/protobuf/cmd/protoc-gen-go
+)
+
+require (
+	buf.build/gen/go/bufbuild/bufplugin/protocolbuffers/go v1.36.12-20261002170247-538130002972.2 // indirect
+	buf.build/gen/go/bufbuild/protodescriptor/protocolbuffers/go v1.36.12-20250109164928-1da0de137947.2 // indirect
+	buf.build/gen/go/bufbuild/protovalidate/protocolbuffers/go v1.36.12-20260825204119-511051f7f437.2 // indirect
+	buf.build/gen/go/bufbuild/registry/connectrpc/go/v2 v2.0.0-20261009230124-4d217860dade.1 // indirect
+	buf.build/gen/go/bufbuild/registry/protocolbuffers/go v1.36.12-20261009230124-4d217860dade.2 // indirect
+	buf.build/gen/go/pluginrpc/pluginrpc/protocolbuffers/go v1.36.12-20241007202033-cf42259fcbfc.2 // indirect
+	buf.build/go/app v0.2.1-0.20260928213032-9a091f2dc726 // indirect
+	buf.build/go/bufplugin v0.11.1 // indirect
+	buf.build/go/bufprivateusage v0.1.0 // indirect
+	buf.build/go/interrupt v1.1.0 // indirect
+	buf.build/go/protovalidate v1.4.0 // indirect
+	buf.build/go/protoyaml v0.7.0 // indirect
+	buf.build/go/spdx v0.3.0 // indirect
+	buf.build/go/standard v0.1.1-0.20260325175353-2b287e071df5 // indirect
+	cel.dev/cel-go v0.32.0 // indirect
+	cel.dev/expr v0.25.3 // indirect
+	connectrpc.com/connect/v2 v2.0.1 // indirect
+	connectrpc.com/otelconnect v0.11.0 // indirect
+	github.com/Microsoft/go-winio v0.6.3 // indirect
+	github.com/antlr4-go/antlr/v4 v4.13.1 // indirect
+	github.com/bufbuild/buf v1.74.0 // indirect
+	github.com/bufbuild/protocompile v0.14.2-0.20261013160345-b79bfe2f85df // indirect
+	github.com/bufbuild/protoplugin v0.0.0-20260414125817-25d1d281b46b // indirect
+	github.com/cespare/xxhash/v2 v2.3.0 // indirect
+	github.com/cli/browser v1.3.0 // indirect
+	github.com/containerd/errdefs v1.0.0 // indirect
+	github.com/containerd/errdefs/pkg v0.3.0 // indirect
+	github.com/cpuguy83/go-md2man/v2 v2.0.7 // indirect
+	github.com/distribution/reference v0.6.0 // indirect
+	github.com/docker/cli v29.9.0+incompatible // indirect
+	github.com/docker/docker-credential-helpers v0.9.10 // indirect
+	github.com/docker/go-connections v0.8.2 // indirect
+	github.com/docker/go-units v0.5.0 // indirect
+	github.com/felixge/httpsnoop v1.1.0 // indirect
+	github.com/go-logr/logr v1.4.4 // indirect
+	github.com/go-logr/stdr v1.2.2 // indirect
+	github.com/gofrs/flock v0.13.1 // indirect
+	github.com/google/go-containerregistry v0.22.1 // indirect
+	github.com/google/uuid v1.6.0 // indirect
+	github.com/inconshreveable/mousetrap v1.1.0 // indirect
+	github.com/jdx/go-netrc v1.0.0 // indirect
+	github.com/klauspost/compress v1.20.3 // indirect
+	github.com/klauspost/pgzip v1.2.7 // indirect
+	github.com/mattn/go-colorable v0.1.16 // indirect
+	github.com/mattn/go-isatty v0.0.24 // indirect
+	github.com/moby/docker-image-spec v1.3.1 // indirect
+	github.com/moby/moby/api v1.56.1 // indirect
+	github.com/moby/moby/client v0.6.2 // indirect
+	github.com/opencontainers/go-digest v1.0.0 // indirect
+	github.com/opencontainers/image-spec v1.1.1 // indirect
+	github.com/petermattis/goid v0.0.0-20260918085751-abfca077860b // indirect
+	github.com/quic-go/qpack v0.6.0 // indirect
+	github.com/quic-go/quic-go v0.63.0 // indirect
+	github.com/rivo/uniseg v0.4.7 // indirect
+	github.com/rs/cors v1.11.1 // indirect
+	github.com/russross/blackfriday/v2 v2.1.0 // indirect
+	github.com/segmentio/asm v1.2.1 // indirect
+	github.com/segmentio/encoding v0.5.4 // indirect
+	github.com/sirupsen/logrus v1.10.2 // indirect
+	github.com/spf13/cobra v1.10.2 // indirect
+	github.com/spf13/pflag v1.0.10 // indirect
+	github.com/tetratelabs/wazero v1.12.0 // indirect
+	github.com/tidwall/btree v1.8.2 // indirect
+	go.lsp.dev/jsonrpc2 v0.10.0 // indirect
+	go.lsp.dev/pkg v0.0.0-20210717090340-384b27a52fb2 // indirect
+	go.lsp.dev/protocol v0.12.0 // indirect
+	go.lsp.dev/uri v0.3.0 // indirect
+	go.opentelemetry.io/auto/sdk v1.2.1 // indirect
+	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.72.0 // indirect
+	go.opentelemetry.io/otel v1.47.0 // indirect
+	go.opentelemetry.io/otel/log v1.47.0 // indirect
+	go.opentelemetry.io/otel/metric v1.47.0 // indirect
+	go.opentelemetry.io/otel/trace v1.47.0 // indirect
+	go.uber.org/multierr v1.11.0 // indirect
+	go.uber.org/zap v1.28.0 // indirect
+	go.yaml.in/yaml/v3 v3.0.5 // indirect
+	golang.org/x/crypto v0.58.0 // indirect
+	golang.org/x/exp v0.0.0-20261011100332-faecfb24eb49 // indirect
+	golang.org/x/mod v0.42.0 // indirect
+	golang.org/x/net v0.61.0 // indirect
+	golang.org/x/sync v0.24.0 // indirect
+	golang.org/x/sys v0.49.0 // indirect
+	golang.org/x/term v0.47.0 // indirect
+	golang.org/x/text v0.43.0 // indirect
+	google.golang.org/genproto/googleapis/api v0.0.0-20261005182115-fad411399dd8 // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20261005182115-fad411399dd8 // indirect
+	google.golang.org/protobuf v1.36.12 // indirect
+	mvdan.cc/xurls/v2 v2.6.0 // indirect
+	pluginrpc.com/pluginrpc v0.6.0 // indirect
+)