build(deps): bundle grpc 1.83.2 and opa 1.20.1

[huang195]

Summary

Bundles two low-risk Dependabot bumps into one PR so they cost a single CI cycle instead of two, plus a rebase:

• google.golang.org/grpc 1.83.1 → 1.83.2 (chore: bump google.golang.org/grpc from 1.83.1 to 1.83.2 in /authbridge/authlib #831)
• github.com/open-policy-agent/opa 1.19.1 → 1.20.1 (chore: bump github.com/open-policy-agent/opa from 1.19.1 to 1.20.1 in /authbridge/authlib #832)

Both PRs rewrite the same six go.mod/go.sum files, so merging them separately means the second one force-rebases and re-runs CI from scratch. Bundling avoids that.

One conflict worth noting

The two branches disagreed on a third dependency. #832 also carried google.golang.org/genproto/googleapis/rpc forward to v0.0.0-20260720211330-0afa2a65878a while pinning grpc at 1.83.1; #831 kept the older genproto revision alongside grpc 1.83.2. Resolved as the union — grpc 1.83.2 with the newer genproto — then re-tidied so the lockfiles agree.

Tidy had to be done by hand

.github/workflows/dependabot-tidy.yml is gated on if: github.actor == 'dependabot[bot]', so it will not run on this human-authored branch. The final commit reproduces its exact loop locally (GOWORK=off, go mod tidy in every authbridge/**/go.mod excluding demos/).

Verification

Run locally against Go 1.26.5 (the version authbridge/authlib/go.mod pins, which is what setup-go resolves in CI via go-version-file):

Module	build	vet	test
authlib	pass	pass	pass
cmd/abctl	pass	pass	—
cmd/authbridge-envoy	pass	pass	—
cmd/authbridge-praxis	pass	pass	—
cmd/authbridge-proxy	pass	pass	—
storage/redis	pass	pass	—
cmd/authbridge-cpex	see note	see note	—

cmd/authbridge-cpex has no packages without -tags cpex (main.go is behind //go:build cpex), so ./... matches nothing there — pre-existing, and that module is not one of the three Go CI jobs. With -tags cpex it compiles but cannot link locally for want of libcpex_ffi from the CPEX Rust build, which is an environment prerequisite unrelated to these bumps.

The diff is purely version bumps: 102 insertions, 102 deletions across 12 files, with no dependency added or removed relative to main.

Closes #831
Closes #832

Assisted-By: Claude Code

Summary by CodeRabbit

• Chores
  • Updated internal libraries and indirect dependencies to newer versions across AuthBridge components.
  • Included updates to gRPC, policy evaluation, compression, metrics, and protocol support libraries.
  • No user-facing features or behavior changes were introduced.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Team

Run ID: 59fce4bb-3cb4-4780-8cea-3aa785c0b5df

📥 Commits

Reviewing files that changed from the base of the PR and between b30ad75 and 7c62383.

⛔ Files ignored due to path filters (6)

• authbridge/authlib/go.sum is excluded by !**/*.sum
• authbridge/cmd/abctl/go.sum is excluded by !**/*.sum
• authbridge/cmd/authbridge-cpex/go.sum is excluded by !**/*.sum
• authbridge/cmd/authbridge-envoy/go.sum is excluded by !**/*.sum
• authbridge/cmd/authbridge-praxis/go.sum is excluded by !**/*.sum
• authbridge/cmd/authbridge-proxy/go.sum is excluded by !**/*.sum

📒 Files selected for processing (6)

• authbridge/authlib/go.mod
• authbridge/cmd/abctl/go.mod
• authbridge/cmd/authbridge-cpex/go.mod
• authbridge/cmd/authbridge-envoy/go.mod
• authbridge/cmd/authbridge-praxis/go.mod
• authbridge/cmd/authbridge-proxy/go.mod

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

The pull request updates dependency versions in six Go modules. It upgrades OPA, gRPC, genproto, klauspost/compress, and Prometheus dependencies without changing exported declarations or application code.

Changes

Go dependency refresh

Layer / File(s)	Summary
Authlib dependency updates authbridge/authlib/go.mod	Updates OPA, gRPC, genproto, klauspost/compress, and Prometheus dependency versions.
Command module dependency alignment authbridge/cmd/*/go.mod	Updates gRPC and genproto versions across command modules, with related OPA, compression, and Prometheus updates in applicable modules.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Merge Risk: ⚪ Minimal · up to 7c623

This change updates bundled gRPC, OPA, and related Go dependency versions without altering application behavior; no actionable merge-blocking risk remains beyond normal checks and review.

Suggested reviewers: ibrahim2595, araujof, abigailgold

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly identifies the bundled gRPC and OPA dependency upgrades, which are the primary changes.
Linked Issues check	✅ Passed	The pull request upgrades gRPC from 1.83.1 to 1.83.2 and OPA from 1.19.1 to 1.20.1 in the affected Go modules. The additional genproto and indirect dependency updates support module resolution and tid…
Out of Scope Changes check	✅ Passed	The changes are limited to Go module dependency and transitive dependency version updates related to the linked upgrade objectives. No unrelated code changes are shown.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…

Full details: Linked Issues check

Explanation

The pull request upgrades gRPC from 1.83.1 to 1.83.2 and OPA from 1.19.1 to 1.20.1 in the affected Go modules. The additional genproto and indirect dependency updates support module resolution and tidying.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (6 skipped: 6 unsupported.)

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch build/bundle-grpc-opa

Warning

Some tools did not complete. Review the errors below.

🔧 golangci-lint (2.13.2)

level=error msg="Running error: context loading failed: no go files to analyze: running go mod tidy may solve the problem"

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[mrsabath]

Summary

Clean dependency-bump bundle. Merges two forward Dependabot bumps into a single CI cycle:

• google.golang.org/grpc 1.83.1 → 1.83.2 (#831)
• github.com/open-policy-agent/opa 1.19.1 → 1.20.1 (#832)

I verified the substance rather than the narrative:

• Pure version bumps. Diffed the module paths on the + vs - side across all six modules' go.mod — every changed require line is a version transition; no module path is added or dropped relative to main. Confirms the "no dependency added or removed" claim.
• Conflict resolution is sound. grpc lands at 1.83.2 with the newer genproto/googleapis/rpc (v0.0.0-20260720211330-0afa2a65878a) — the union of the two branches, and the lockfiles agree after tidy.
• tidy skipping is expected, not a gap: dependabot-tidy.yml is gated on github.actor == 'dependabot[bot]', so it can't run on a human branch. The final commits reproduce that loop by hand.

All CI green — the three Go CI jobs (authlib / authbridge-envoy / authbridge-proxy), Dependency Review (supply-chain gate), CodeQL, Trivy, and CodeRabbit. 4 commits, all DCO-signed.

Bundling to save a CI cycle is 一举两得 (one move, two gains). LGTM.

Areas reviewed: Go dependencies (go.mod/go.sum), CI status, supply-chain (Dependency Review)
Commits: 4, all signed-off (DCO passes)
CI status: passing (tidy skipped by design)