Update google.golang.org/genproto/googleapis/api digest to 08b0e42 - #446

#!/bin/bash
set -euo pipefail

specs=(
  "google.golang.org/genproto/googleapis/api@v0.0.0-20260819154853-08b0e4226688"
  "google.golang.org/genproto/googleapis/rpc@v0.0.0-20260818201246-1b0934165a6f"
  "google.golang.org/protobuf@v1.36.12"
)

for spec in "${specs[@]}"; do
  module="${spec%@*}"
  version="${spec#*@}"
  metadata="$(go mod download -json "$spec")"

  sum="$(jq -r '.Sum // empty' <<<"$metadata")"
  gomod_sum="$(jq -r '.GoModSum // empty' <<<"$metadata")"

  grep -Fq "$module $version " go.sum
  grep -Fq "$module $version/go.mod " go.sum

  if [[ -n "$sum" ]]; then
    grep -Fq "$sum" go.sum
  fi
  if [[ -n "$gomod_sum" ]]; then
    grep -Fq "$gomod_sum" go.sum
  fi

  result="$(
    curl -fsS -X POST https://api.osv.dev/v1/query \
      -H 'Content-Type: application/json' \
      --data "$(jq -nc \
        --arg name "$module" \
        --arg version "$version" \
        '{package:{ecosystem:"Go",name:$name},version:$version}')"
  )"

  test "$(jq '.vulns // [] | length' <<<"$result")" -eq 0
done

if ! rg -n -i 'sbom|syft|cyclonedx|provenance|slsa|attest|cosign|sigstore' .; then
  echo "No SBOM, provenance, or artifact-signing configuration was found." >&2
  exit 1
fi

set -euo pipefail

printf '%s\n' '--- module declarations and replacement ---'
sed -n '1,25p' go.mod
printf '%s\n' '--- API module ---'
sed -n '1,25p' api/go.mod

printf '%s\n' '--- dependency hashes ---'
rg -n -F \
  -e 'google.golang.org/genproto/googleapis/api v0.0.0-20260819154853-08b0e4226688' \
  -e 'google.golang.org/genproto/googleapis/rpc v0.0.0-20260818201246-1b0934165a6f' \
  -e 'google.golang.org/protobuf v1.36.12' \
  go.sum

printf '%s\n' '--- release and supply-chain references ---'
rg -n -i \
  'sbom|syft|cyclonedx|provenance|slsa|attest|cosign|sigstore|license|dependabot|osv|govulncheck' \
  .github Makefile Dockerfile* Containerfile* 2>/dev/null || true

printf '%s\n' '--- dependency-related files ---'
git ls-files '*go.mod' '*go.sum' '*LICENSE*' '*NOTICE*' '.github/workflows/*' '.tekton/*' 2>/dev/null

set -euo pipefail
for spec in \
  'google.golang.org/genproto/googleapis/api@v0.0.0-20260819154853-08b0e4226688' \
  'google.golang.org/genproto/googleapis/rpc@v0.0.0-20260818201246-1b0934165a6f' \
  'google.golang.org/protobuf@v1.36.12'; do
  echo "== $spec =="
  go mod download -json "$spec" | jq '{Path,Version,Sum,GoModSum,Error}'
done

set -euo pipefail

printf '%s\n' '--- root module replacement directives ---'
rg -n '^(replace|exclude|toolchain|go )' go.mod api/go.mod || true
tail -n 30 go.mod

printf '%s\n' '--- release workflow ---'
sed -n '1,240p' .github/workflows/release-cli.yml

printf '%s\n' '--- dependency licenses from the Go module cache ---'
cache="$(go env GOMODCACHE)"
for dir in \
  'google.golang.org/genproto/googleapis/api@v0.0.0-20260819154853-08b0e4226688' \
  'google.golang.org/genproto/googleapis/rpc@v0.0.0-20260818201246-1b0934165a6f' \
  'google.golang.org/protobuf@v1.36.12'; do
  printf '%s\n' "== $dir =="
  find "$cache/$dir" -maxdepth 1 -type f \
    \( -iname 'license*' -o -iname 'copying*' -o -iname 'notice*' \) \
    -print -exec sed -n '1,12p' {} \; 2>/dev/null || true
done

set -euo pipefail
rg -n -i 'sbom|syft|cyclonedx|provenance|slsa|attest|cosign|sigstore' . --hidden \
  -g '!**/.git/**' -g '!go.sum' || true