protobuf: Switch to protovalidate

Signed-off-by: Ryan Northey <ryan@synca.io>

Author: phlax

MODULE.bazel

@@ -14,6 +14,7 @@ bazel_dep(name = "googleapis-cc", version = "1.0.0")
 bazel_dep(name = "grpc", version = "1.76.0.bcr.1", repo_name = "com_github_grpc_grpc")
 bazel_dep(name = "protobuf", version = "33.1", repo_name = "com_google_protobuf")
 bazel_dep(name = "protoc-gen-validate", version = "1.3.0", repo_name = "com_envoyproxy_protoc_gen_validate")
+bazel_dep(name = "protovalidate", version = "1.0.0")
 bazel_dep(name = "re2", version = "2025-11-05.bcr.1", repo_name = "com_googlesource_code_re2")
 bazel_dep(name = "rules_cc", version = "0.2.14")
 bazel_dep(name = "rules_go", version = "0.59.0", repo_name = "io_bazel_rules_go")
@@ -56,9 +57,22 @@ go_deps.module(
     sum = "h1:AYd7cD/uASjIL6Q9LiTjz8JLcrh/88q5UObnmY3aOOE=",
     version = "v1.36.10",
 )
+go_deps.module(
+    path = "github.com/bufbuild/protovalidate-go",
+    sum = "h1:pJZLbm2VHJy+IYCZxQW8yhaQdOOJVCIzH4IELVcQpSM=",
+    version = "v0.8.0",
+)
+go_deps.module(
+    path = "buf.build/gen/go/bufbuild/protovalidate/protocolbuffers/go",
+    sum = "h1:PMmTMyvHScV9Mn8wc6ASge9uRcHy0jtqPd+fM35LmsQ=",
+    version = "v1.36.11-20260209202127-80ab13bee0bf.1",
+)
+
 use_repo(
     go_deps,
     "org_golang_google_genproto_googleapis_api",
     "org_golang_google_grpc",
     "org_golang_google_protobuf",
+    protovalidate_go = "com_github_bufbuild_protovalidate_go",
+    protovalidate_go_gen = "build_buf_gen_go_bufbuild_protovalidate_protocolbuffers_go",
 )

bazel/api_build_system.bzl

@@ -1,6 +1,6 @@
-load("@com_envoyproxy_protoc_gen_validate//bazel:pgv_proto_library.bzl", "pgv_cc_proto_library")
 load("@com_github_grpc_grpc//bazel:cc_grpc_library.bzl", "cc_grpc_library")
 load("@com_github_grpc_grpc//bazel:python_rules.bzl", _py_proto_library = "py_proto_library")
+load("@com_google_protobuf//bazel:cc_proto_library.bzl", "cc_proto_library")
 load("@com_google_protobuf//bazel:proto_library.bzl", "proto_library")
 load("@io_bazel_rules_go//go:def.bzl", "go_test")
 load("@io_bazel_rules_go//proto:def.bzl", "go_grpc_library", "go_proto_library")
@@ -27,7 +27,7 @@ _COMMON_PROTO_DEPS = [
     "@com_google_protobuf//:wrappers_proto",
     "@com_google_googleapis//google/api:http_proto",
     "@com_google_googleapis//google/rpc:status_proto",
-    "@com_envoyproxy_protoc_gen_validate//validate:validate_proto",
+    "@protovalidate//proto/protovalidate/buf/validate:validate_proto",
 ]
 
 def _proto_mapping(dep, proto_dep_map, proto_suffix):
@@ -68,14 +68,8 @@ def _xds_cc_py_proto_library(
         visibility = visibility,
     )
     cc_proto_library_name = name + _CC_PROTO_SUFFIX
-    pgv_cc_proto_library(
+    cc_proto_library(
         name = cc_proto_library_name,
-        linkstatic = linkstatic,
-        cc_deps = [_cc_proto_mapping(dep) for dep in deps] + [
-            "@com_google_googleapis//google/api:http_cc_proto",
-            "@com_google_googleapis//google/api:httpbody_cc_proto",
-            "@com_google_googleapis//google/rpc:status_cc_proto",
-        ],
         deps = [relative_name],
         visibility = ["//visibility:public"],
     )
@@ -113,9 +107,9 @@ def xds_proto_package(
         has_services = has_services,
     )
 
-    compilers = ["@io_bazel_rules_go//proto:go_proto", "@com_envoyproxy_protoc_gen_validate//bazel/go:pgv_plugin_go"]
+    compilers = ["@io_bazel_rules_go//proto:go_proto"]
     if has_services:
-        compilers = ["@io_bazel_rules_go//proto:go_proto", "@io_bazel_rules_go//proto:go_grpc_v2", "@com_envoyproxy_protoc_gen_validate//bazel/go:pgv_plugin_go"]
+        compilers = ["@io_bazel_rules_go//proto:go_proto", "@io_bazel_rules_go//proto:go_grpc_v2"]
 
     # Because RBAC proro depends on googleapis syntax.proto and checked.proto,
     # which share the same go proto library, it causes duplicative dependencies.
@@ -127,12 +121,12 @@ def xds_proto_package(
         proto = name,
         visibility = ["//visibility:public"],
         deps = depset([_go_proto_mapping(dep) for dep in deps] + [
-            "@com_envoyproxy_protoc_gen_validate//validate:go_default_library",
             "@org_golang_google_protobuf//types/known/anypb:go_default_library",
             "@org_golang_google_protobuf//types/known/durationpb:go_default_library",
             "@org_golang_google_protobuf//types/known/structpb:go_default_library",
             "@org_golang_google_protobuf//types/known/timestamppb:go_default_library",
             "@org_golang_google_protobuf//types/known/wrapperspb:go_default_library",
+            "@protovalidate_go_gen//buf/validate",
         ]).to_list(),
     )
 

go/go.mod

@@ -3,8 +3,8 @@ module github.com/cncf/xds/go
 go 1.24.6
 
 require (
+	buf.build/gen/go/bufbuild/protovalidate/protocolbuffers/go v1.36.11-20260209202127-80ab13bee0bf.1
 	cel.dev/expr v0.25.1
-	github.com/envoyproxy/protoc-gen-validate v1.3.0
 	google.golang.org/genproto/googleapis/api v0.0.0-20250804133106-a7a43d27e69b
 	google.golang.org/grpc v1.76.0
 	google.golang.org/protobuf v1.36.10