[Audit-Medium] build telemetry is sent once per ProtoFile, not once p…

[pepone]

AI-generated audit finding — this issue was opened from an automated security/correctness audit. It has not been triaged by a human yet; verify the reasoning, reproducibility, and severity before acting on it.

Medium: build telemetry is sent once per ProtoFile, not once per logical compilation — CONFIRMED

Affected code:

• src/IceRpc.Protobuf.Tools/IceRpc.Protobuf.Tools.targets:77-89 — comment explicitly says "We run a separate protoc for each ProtoFile"; ProtocTask is invoked per _ProtoFile item with Sources="%(_ProtoFile.Identity)"
• src/IceRpc.Protobuf.Tools/ProtocTask.cs:82-98 — the --icerpc-build-telemetry_out switch is appended on every invocation when RunBuildTelemetry is true
• src/IceRpc.Protobuf.BuildTelemetry/Program.cs:37-55 — fileCount and hashBytes are computed from the current CodeGeneratorRequest.FileToGenerate
• src/IceRpc.Protobuf.BuildTelemetry/Program.cs:59-127 — the upload happens whenever fileCount > 0, i.e. once per invocation

Verification:

Confirmed. Because ProtoCompile fans out to one protoc call per .proto file and the telemetry plug-in runs inside each protoc invocation, a single logical build that compiles N .proto files produces N telemetry uploads, each reporting FileCount = 1 and a per-file compilation hash. The documentation and ProtobufTelemetryData shape imply whole-build telemetry, which this structure cannot produce.

Impact:

• Server-side telemetry overcounts usage and understates per-build compilation size.
• The 3-second network timeout is paid once per .proto file when the server is slow/unreachable — a 20-file project can spend a minute in telemetry when offline.

Recommendation:

• Move telemetry out of the per-file protoc invocation and emit one report from a dedicated MSBuild task after all ProtocTask invocations complete.
• If per-file protoc must remain, disable telemetry there and run a single BuildTelemetryTask (the task is already declared at IceRpc.Protobuf.Tools.targets:30).

Status: Valid, Medium severity.

---

Source report: src-IceRpc.Protobuf.BuildTelemetry-audit-2026-04-14.md (finding build telemetry is sent once per ProtoFile, not once per logical compilation — **CONFIRMED**)

Severity (auditor-assigned): Medium