Add protovalidate lint rules

go.mod

@@ -6,10 +6,12 @@ require (
 	connectrpc.com/connect v1.11.1
 	connectrpc.com/otelconnect v0.5.0
 	github.com/bufbuild/protocompile v0.6.0
+	github.com/bufbuild/protovalidate-go v0.3.3-0.20231002212436-9023bd754f7f
 	github.com/docker/docker v24.0.6+incompatible
 	github.com/go-chi/chi/v5 v5.0.10
 	github.com/gofrs/flock v0.8.1
 	github.com/gofrs/uuid/v5 v5.0.0
+	github.com/google/cel-go v0.18.1
 	github.com/google/go-cmp v0.5.9
 	github.com/google/go-containerregistry v0.16.1
 	github.com/jdx/go-netrc v1.0.0
@@ -43,6 +45,7 @@ require (
 require (
 	github.com/Azure/go-ansiterm v0.0.0-20230124172434-306776ec8161 // indirect
 	github.com/Microsoft/go-winio v0.6.1 // indirect
+	github.com/antlr/antlr4/runtime/Go/antlr/v4 v4.0.0-20230512164433-5d1fd1a340c9 // indirect
 	github.com/benbjohnson/clock v1.3.5 // indirect
 	github.com/containerd/stargz-snapshotter/estargz v0.14.3 // indirect
 	github.com/cpuguy83/go-md2man/v2 v2.0.2 // indirect
@@ -68,8 +71,11 @@ require (
 	github.com/pmezard/go-difflib v1.0.0 // indirect
 	github.com/russross/blackfriday/v2 v2.1.0 // indirect
 	github.com/sirupsen/logrus v1.9.3 // indirect
+	github.com/stoewer/go-strcase v1.3.0 // indirect
 	github.com/vbatts/tar-split v0.11.5 // indirect
 	go.opentelemetry.io/otel/metric v1.17.0 // indirect
 	golang.org/x/sys v0.12.0 // indirect
 	golang.org/x/text v0.13.0 // indirect
+	google.golang.org/genproto/googleapis/api v0.0.0-20230913181813-007df8e322eb // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20230913181813-007df8e322eb // indirect
 )

go.sum

@@ -6,10 +6,14 @@ github.com/Azure/go-ansiterm v0.0.0-20230124172434-306776ec8161 h1:L/gRVlceqvL25
 github.com/Azure/go-ansiterm v0.0.0-20230124172434-306776ec8161/go.mod h1:xomTg63KZ2rFqZQzSB4Vz2SUXa1BpHTVz9L5PTmPC4E=
 github.com/Microsoft/go-winio v0.6.1 h1:9/kr64B9VUZrLm5YYwbGtUJnMgqWVOdUAXu6Migciow=
 github.com/Microsoft/go-winio v0.6.1/go.mod h1:LRdKpFKfdobln8UmuiYcKPot9D2v6svN5+sAH+4kjUM=
+github.com/antlr/antlr4/runtime/Go/antlr/v4 v4.0.0-20230512164433-5d1fd1a340c9 h1:goHVqTbFX3AIo0tzGr14pgfAW2ZfPChKO21Z9MGf/gk=
+github.com/antlr/antlr4/runtime/Go/antlr/v4 v4.0.0-20230512164433-5d1fd1a340c9/go.mod h1:pSwJ0fSY5KhvocuWSx4fz3BA8OrA1bQn+K1Eli3BRwM=
 github.com/benbjohnson/clock v1.3.5 h1:VvXlSJBzZpA/zum6Sj74hxwYI2DIxRWuNIoXAzHZz5o=
 github.com/benbjohnson/clock v1.3.5/go.mod h1:J11/hYXuz8f4ySSvYwY0FKfm+ezbsZBKZxNJlLklBHA=
 github.com/bufbuild/protocompile v0.6.0 h1:Uu7WiSQ6Yj9DbkdnOe7U4mNKp58y9WDMKDn28/ZlunY=
 github.com/bufbuild/protocompile v0.6.0/go.mod h1:YNP35qEYoYGme7QMtz5SBCoN4kL4g12jTtjuzRNdjpE=
+github.com/bufbuild/protovalidate-go v0.3.3-0.20231002212436-9023bd754f7f h1:jU4Wz/Kz8i4wSd/wTScUkRHRxl6lV6bp/7aQnqTPkjs=
+github.com/bufbuild/protovalidate-go v0.3.3-0.20231002212436-9023bd754f7f/go.mod h1:36yOYnOgeU1gtdIC/J+SKt+jww0gXMW5j/KZzgYuOJU=
 github.com/chzyer/logex v1.1.10/go.mod h1:+Ywpsq7O8HXn0nuIou7OrIPyXbp3wmkHB+jjWRnGsAI=
 github.com/chzyer/readline v0.0.0-20180603132655-2972be24d48e/go.mod h1:nSuG5e5PlCu98SY8svDHJxuZscDgtXS6KTTbou5AhLI=
 github.com/chzyer/test v0.0.0-20180213035817-a1ea475d72b1/go.mod h1:Q3SI9o4m/ZMnBNeIyt5eFwwo7qiLfzFZmjNmxjkiQlU=
@@ -51,6 +55,8 @@ github.com/gogo/protobuf v1.3.2/go.mod h1:P1XiOD3dCwIKUDQYPy72D8LYyHL2YPYrpS2s69
 github.com/golang/protobuf v1.5.0/go.mod h1:FsONVRAS9T7sI+LIUmWTfcYkHO4aIWwzhcaSAoJOfIk=
 github.com/golang/protobuf v1.5.3 h1:KhyjKVUg7Usr/dYsdSqoFveMYd5ko72D+zANwlG1mmg=
 github.com/golang/protobuf v1.5.3/go.mod h1:XVQd3VNwM+JqD3oG2Ue2ip4fOMUkwXdXDdiuN0vRsmY=
+github.com/google/cel-go v0.18.1 h1:V/lAXKq4C3BYLDy/ARzMtpkEEYfHQpZzVyzy69nEUjs=
+github.com/google/cel-go v0.18.1/go.mod h1:PVAybmSnWkNMUZR/tEWFUiJ1Np4Hz0MHsZJcgC4zln4=
 github.com/google/go-cmp v0.5.5/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/google/go-cmp v0.5.9 h1:O2Tfq5qg4qc4AmwVlvv0oLiVAGB7enBSJ2x2DqQFi38=
 github.com/google/go-cmp v0.5.9/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
@@ -102,11 +108,15 @@ github.com/spf13/cobra v1.7.0 h1:hyqWnYt1ZQShIddO5kBpj3vu05/++x6tJ6dg8EC572I=
 github.com/spf13/cobra v1.7.0/go.mod h1:uLxZILRyS/50WlhOIKD7W6V5bgeIt+4sICxh6uRMrb0=
 github.com/spf13/pflag v1.0.5 h1:iy+VFUOCP1a+8yFto/drg2CJ5u0yRoB7fZw3DKv/JXA=
 github.com/spf13/pflag v1.0.5/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
+github.com/stoewer/go-strcase v1.3.0 h1:g0eASXYtp+yvN9fK8sH94oCIk0fau9uV1/ZdJ0AVEzs=
+github.com/stoewer/go-strcase v1.3.0/go.mod h1:fAH5hQ5pehh+j3nZfvwdk2RgEgQjAoM8wodgtPmh1xo=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
 github.com/stretchr/objx v0.4.0/go.mod h1:YvHI0jy2hoMjB+UWwv71VJQ9isScKT/TqJzVSSt89Yw=
+github.com/stretchr/objx v0.5.0/go.mod h1:Yh+to48EsGEfYuaHDzXPcE3xhTkx73EhmCGUpEOglKo=
 github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
 github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
 github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU=
+github.com/stretchr/testify v1.8.1/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4=
 github.com/stretchr/testify v1.8.4 h1:CcVxjf3Q8PM0mHUKJCdn+eZZtm5yQwehR5yeSVQQcUk=
 github.com/stretchr/testify v1.8.4/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXlSw2iwfAo=
 github.com/tetratelabs/wazero v1.5.0 h1:Yz3fZHivfDiZFUXnWMPUoiW7s8tC1sjdBtlJn08qYa0=
@@ -179,7 +189,10 @@ golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8T
 golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20230525234030-28d5490b6b19 h1:0nDDozoAU19Qb2HwhXadU8OcsiO/09cnTqhUtq2MEOM=
+google.golang.org/genproto/googleapis/api v0.0.0-20230913181813-007df8e322eb h1:lK0oleSc7IQsUxO3U5TjL9DWlsxpEBemh+zpB7IqhWI=
+google.golang.org/genproto/googleapis/api v0.0.0-20230913181813-007df8e322eb/go.mod h1:KjSP20unUpOx5kyQUFa7k4OJg0qeJ7DEZflGDu2p6Bk=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20230913181813-007df8e322eb h1:Isk1sSH7bovx8Rti2wZK0UZF6oraBDK74uoyLEEVFN0=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20230913181813-007df8e322eb/go.mod h1:+Bk1OCOj40wS2hwAMA+aCW9ypzm63QTBBHp6lQ3p+9M=
 google.golang.org/grpc v1.57.0 h1:kfzNeI/klCGD2YPMUlaGNT3pxvYfga7smW3Vth8Zsiw=
 google.golang.org/protobuf v1.26.0-rc.1/go.mod h1:jlhhOSvTdKEhbULTjvd4ARK9grFBp09yW+WbY/TyQbw=
 google.golang.org/protobuf v1.26.0/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc=

make/buf/all.mk

@@ -36,6 +36,8 @@ BUF_BREAKING_INPUT := .
 BUF_BREAKING_AGAINST_INPUT ?= .git\#branch=main
 BUF_FORMAT_INPUT := .
 
+PROTOVALIDATE_VERSION := v0.4.3
+
 include make/go/bootstrap.mk
 include make/go/dep_buf.mk
 include make/go/dep_minisign.mk
@@ -99,20 +101,32 @@ bufgeneratedeps:: \
 bufgeneratecleango:
 	rm -rf private/gen/proto
 
-bufgenerateclean:: bufgeneratecleango
+.PHONY: bufgeneratecleanprotovalidatetestdata
+bufgeneratecleanprotovalidatetestdata:
+	rm -rf private/bufpkg/bufcheck/buflint/testdata/deps/protovalidate
+
+bufgenerateclean:: \
+	bufgeneratecleango \
+	bufgeneratecleanprotovalidatetestdata
 
 .PHONY: bufgenerateprotogo
 bufgenerateprotogo:
 	$(BUF_BIN) generate proto --template data/template/buf.go.gen.yaml
 	$(BUF_BIN) generate buf.build/grpc/grpc --type grpc.reflection.v1.ServerReflection --template data/template/buf.go.gen.yaml
+	$(BUF_BIN) generate buf.build/bufbuild/protovalidate:$(PROTOVALIDATE_VERSION) --template data/template/buf.go.gen.yaml
 
 .PHONY: bufgenerateprotogoclient
 bufgenerateprotogoclient:
 	$(BUF_BIN) generate proto --template data/template/buf.go-client.gen.yaml
 
+.PHONY: bufgenerateprotovalidatetestdata
+bufgenerateprotovalidatetestdata:
+	$(BUF_BIN) export buf.build/bufbuild/protovalidate:$(PROTOVALIDATE_VERSION) --output private/bufpkg/bufcheck/buflint/testdata/deps/protovalidate
+
 bufgeneratesteps:: \
 	bufgenerateprotogo \
-	bufgenerateprotogoclient
+	bufgenerateprotogoclient \
+	bufgenerateprotovalidatetestdata
 
 .PHONY: bufrelease
 bufrelease: $(MINISIGN)

private/buf/cmd/buf/buf_test.go

@@ -522,6 +522,7 @@ RPC_REQUEST_RESPONSE_UNIQUE       DEFAULT                  Checks that RPC reque
 RPC_REQUEST_STANDARD_NAME         DEFAULT                  Checks that RPC request type names are RPCNameRequest or ServiceNameRPCNameRequest (configurable).
 RPC_RESPONSE_STANDARD_NAME        DEFAULT                  Checks that RPC response type names are RPCNameResponse or ServiceNameRPCNameResponse (configurable).
 SERVICE_SUFFIX                    DEFAULT                  Checks that services are suffixed with Service (suffix is configurable).
+VALIDATE_CEL_EXPRESSIONS_COMPILE  DEFAULT                  Checks that protovalidate cel expressions compile.
 COMMENT_ENUM                      COMMENTS                 Checks that enums have non-empty comments.
 COMMENT_ENUM_VALUE                COMMENTS                 Checks that enum values have non-empty comments.
 COMMENT_FIELD                     COMMENTS                 Checks that fields have non-empty comments.

private/bufpkg/bufcheck/buflint/buflint_test.go

@@ -479,6 +479,7 @@ func TestRunPackageNoImportCycle(t *testing.T) {
 			require.NoError(t, err)
 			return newImage
 		},
+		"",
 		bufanalysistesting.NewFileAnnotation(t, "c1.proto", 5, 1, 5, 19, "PACKAGE_NO_IMPORT_CYCLE"),
 		bufanalysistesting.NewFileAnnotation(t, "d1.proto", 5, 1, 5, 19, "PACKAGE_NO_IMPORT_CYCLE"),
 	)
@@ -844,6 +845,21 @@ func TestRunIgnores4(t *testing.T) {
 	)
 }
 
+func TestRunValidateCelExpressionsCompile(t *testing.T) {
+	t.Parallel()
+	testLintWithValidate(
+		t,
+		"validate_cel_expressions_compile",
+		bufanalysistesting.NewFileAnnotation(t, "a.proto", 9, 37, 13, 4, "VALIDATE_CEL_EXPRESSIONS_COMPILE"),
+		bufanalysistesting.NewFileAnnotation(t, "a.proto", 16, 5, 20, 6, "VALIDATE_CEL_EXPRESSIONS_COMPILE"),
+		bufanalysistesting.NewFileAnnotation(t, "a.proto", 28, 5, 32, 6, "VALIDATE_CEL_EXPRESSIONS_COMPILE"),
+		bufanalysistesting.NewFileAnnotation(t, "a.proto", 34, 39, 38, 4, "VALIDATE_CEL_EXPRESSIONS_COMPILE"),
+		bufanalysistesting.NewFileAnnotation(t, "a.proto", 59, 3, 63, 5, "VALIDATE_CEL_EXPRESSIONS_COMPILE"),
+		bufanalysistesting.NewFileAnnotation(t, "a.proto", 75, 5, 79, 6, "VALIDATE_CEL_EXPRESSIONS_COMPILE"),
+		bufanalysistesting.NewFileAnnotation(t, "a.proto", 87, 5, 91, 6, "VALIDATE_CEL_EXPRESSIONS_COMPILE"),
+	)
+}
+
 func TestCommentIgnoresOff(t *testing.T) {
 	t.Parallel()
 	testLint(
@@ -896,6 +912,7 @@ func TestCommentIgnoresOn(t *testing.T) {
 			config.Lint.AllowCommentIgnores = true
 		},
 		nil,
+		"",
 	)
 }
 
@@ -949,6 +966,7 @@ func TestCommentIgnoresCascadeOn(t *testing.T) {
 			config.Lint.AllowCommentIgnores = true
 		},
 		nil,
+		"",
 	)
 }
 
@@ -962,6 +980,24 @@ func testLint(
 		relDirPath,
 		nil,
 		nil,
+		"",
+		expectedFileAnnotations...,
+	)
+}
+
+func testLintWithValidate(
+	t *testing.T,
+	relDirPath string,
+	expectedFileAnnotations ...bufanalysis.FileAnnotation,
+) {
+	testLintWithModifiers(
+		t,
+		relDirPath,
+		func(config *bufconfig.Config) {
+			config.Lint.IgnoreRootPaths = []string{"buf"}
+		},
+		nil,
+		"deps/protovalidate",
 		expectedFileAnnotations...,
 	)
 }
@@ -971,6 +1007,7 @@ func testLintWithModifiers(
 	relDirPath string,
 	configModifier func(*bufconfig.Config),
 	imageModifier func(bufimage.Image) bufimage.Image,
+	dependencyPathPrefix string,
 	expectedFileAnnotations ...bufanalysis.FileAnnotation,
 ) {
 	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
@@ -991,12 +1028,27 @@ func testLintWithModifiers(
 		configModifier(config)
 	}
 
-	module, err := bufmodulebuild.NewModuleBucketBuilder().BuildForBucket(
-		context.Background(),
-		readWriteBucket,
-		config.Build,
-	)
-	require.NoError(t, err)
+	var module *bufmodulebuild.BuiltModule
+	if dependencyPathPrefix != "" {
+		dependencyReadWriteBucket, err := storageosProvider.NewReadWriteBucket(
+			filepath.Join("testdata", dependencyPathPrefix),
+			storageos.ReadWriteBucketWithSymlinksIfSupported(),
+		)
+		require.NoError(t, err)
+		module, err = bufmodulebuild.NewModuleBucketBuilder().BuildForBucket(
+			context.Background(),
+			storage.MultiReadBucket(dependencyReadWriteBucket, readWriteBucket),
+			config.Build,
+		)
+		require.NoError(t, err)
+	} else {
+		module, err = bufmodulebuild.NewModuleBucketBuilder().BuildForBucket(
+			context.Background(),
+			readWriteBucket,
+			config.Build,
+		)
+		require.NoError(t, err)
+	}
 	image, fileAnnotations, err := bufimagebuild.NewBuilder(
 		zap.NewNop(),
 		bufmodule.NewNopModuleReader(),

private/bufpkg/bufcheck/buflint/internal/buflintbuild/buflintbuild.go

@@ -348,6 +348,13 @@ var (
 		"all files have a syntax specified",
 		newAdapter(buflintcheck.CheckSyntaxSpecified),
 	)
+
+	// SyntaxSpecifiedRuleBuilder is a rule builder.
+	ValidateCelExpressionsCompileRuleBuilder = internal.NewNopRuleBuilder(
+		"VALIDATE_CEL_EXPRESSIONS_COMPILE",
+		"protovalidate cel expressions compile",
+		newAdapter(buflintcheck.CheckValidateCelExpressionsCompile),
+	)
 )
 
 func newAdapter(

private/bufpkg/bufcheck/buflint/internal/buflintcheck/buflintcheck.go

@@ -24,11 +24,14 @@ import (
 	"strings"
 
 	"github.com/bufbuild/buf/private/bufpkg/bufanalysis"
+	"github.com/bufbuild/buf/private/bufpkg/bufcheck/buflint/internal/buflintvalidate"
 	"github.com/bufbuild/buf/private/bufpkg/bufcheck/internal"
 	"github.com/bufbuild/buf/private/pkg/normalpath"
+	"github.com/bufbuild/buf/private/pkg/protodescriptor"
 	"github.com/bufbuild/buf/private/pkg/protosource"
 	"github.com/bufbuild/buf/private/pkg/protoversion"
 	"github.com/bufbuild/buf/private/pkg/stringutil"
+	"google.golang.org/protobuf/reflect/protodesc"
 )
 
 const (
@@ -972,3 +975,25 @@ func checkSyntaxSpecified(add addFunc, file protosource.File) error {
 	}
 	return nil
 }
+
+// CheckValidateCelExpressionsCompile is a check function.
+func CheckValidateCelExpressionsCompile(id string, ignoreFunc internal.IgnoreFunc, files []protosource.File) ([]bufanalysis.FileAnnotation, error) {
+	fileDescriptors := make([]protodescriptor.FileDescriptor, 0, len(files))
+	for _, file := range files {
+		fileDescriptors = append(fileDescriptors, file.FileDescriptor())
+	}
+	resolver, err := protodesc.NewFiles(protodescriptor.FileDescriptorSetForFileDescriptors(fileDescriptors...))
+	if err != nil {
+		return nil, err
+	}
+	helper := internal.NewHelper(id, ignoreFunc)
+	for _, file := range files {
+		if file.IsImport() {
+			continue
+		}
+		if err := buflintvalidate.CheckCelInFile(resolver, helper.AddFileAnnotationWithExtraIgnoreLocationsf, file); err != nil {
+			return nil, err
+		}
+	}
+	return helper.FileAnnotations(), nil
+}

private/bufpkg/bufcheck/buflint/internal/buflintv1/vars.go

@@ -65,6 +65,7 @@ var (
 		buflintbuild.ServicePascalCaseRuleBuilder,
 		buflintbuild.ServiceSuffixRuleBuilder,
 		buflintbuild.SyntaxSpecifiedRuleBuilder,
+		buflintbuild.ValidateCelExpressionsCompileRuleBuilder,
 	}
 
 	// v1DefaultCategories are the default categories.
@@ -229,5 +230,8 @@ var (
 			"BASIC",
 			"DEFAULT",
 		},
+		"VALIDATE_CEL_EXPRESSIONS_COMPILE": {
+			"DEFAULT",
+		},
 	}
 )

private/bufpkg/bufcheck/buflint/internal/buflintvalidate/buflintvalidate.go

@@ -0,0 +1,38 @@
+// Copyright 2020-2023 Buf Technologies, Inc.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package buflintvalidate
+
+import (
+	"github.com/bufbuild/buf/private/pkg/protosource"
+	"google.golang.org/protobuf/reflect/protodesc"
+)
+
+func CheckCelInFile(
+	resolver protodesc.Resolver,
+	add func(protosource.Descriptor, protosource.Location, []protosource.Location, string, ...interface{}),
+	file protosource.File,
+) error {
+	for _, message := range file.Messages() {
+		if err := checkCelInMessage(resolver, add, message); err != nil {
+			return err
+		}
+	}
+	for _, extensionField := range file.Extensions() {
+		if err := checkCelInField(resolver, add, extensionField); err != nil {
+			return err
+		}
+	}
+	return nil
+}