Streamline Dev Dependencies

.github/CODEOWNERS

@@ -102,7 +102,10 @@
 /core/chainlink.Dockerfile @smartcontractkit/devex-cicd @smartcontractkit/foundations @smartcontractkit/core
 
 # Dependencies
-.tool-versions @smartcontractkit/core
+.tool-versions @smartcontractkit/core @smartcontractkit/devex
+/tools/go-tools.txt @smartcontractkit/core @smartcontractkit/devex
+/tools/version-exceptions.yaml @smartcontractkit/core @smartcontractkit/devex
+/tools/toolversion/ @smartcontractkit/core @smartcontractkit/devex
 go.md @smartcontractkit/core @smartcontractkit/foundations
 go.mod @smartcontractkit/core @smartcontractkit/foundations
 go.sum @smartcontractkit/core @smartcontractkit/foundations

.github/actions/golangci-lint/action.yml

@@ -64,13 +64,18 @@ runs:
           echo "golangci-lint-working-directory=${{ inputs.go-directory }}/" >> "${GITHUB_OUTPUT}"
         fi
 
+    - name: Resolve golangci-lint version
+      shell: bash
+      id: golangci-version
+      run: echo "version=$(go run ./tools/toolversion ref golangci-lint)" >> "${GITHUB_OUTPUT}"
+
     - name: Golangci-lint
       uses: golangci/golangci-lint-action@4afd733a84b1f43292c63897423277bb7f4313a9 # v8.0.0
       env:
         # golangci-lint runs with absolute path mode: --path-mode=abs
         REPORT_PATH: ${{ github.workspace }}/${{ steps.set-working-directory.outputs.golangci-lint-working-directory }}golangci-lint-report.xml
       with:
-        version: v2.11.4
+        version: ${{ steps.golangci-version.outputs.version }}
         only-new-issues: true
         args: --output.checkstyle.path=${{ env.REPORT_PATH }}
         working-directory: ${{ steps.set-working-directory.outputs.golangci-lint-working-directory }}

.github/actions/setup-nodejs/action.yaml

@@ -11,13 +11,20 @@ description: Setup pnpm for contracts
 runs:
   using: composite
   steps:
+    - name: Resolve node and pnpm versions
+      shell: bash
+      id: tool-versions
+      run: |
+        echo "nodejs=$(go run ./tools/toolversion get nodejs)" >> "${GITHUB_OUTPUT}"
+        echo "pnpm=$(go run ./tools/toolversion get pnpm)" >> "${GITHUB_OUTPUT}"
+
     - uses: pnpm/action-setup@a3252b78c470c02df07e9d59298aecedc3ccdd6d # v3.0.0
       with:
-        version: ^10.0.0
+        version: ${{ steps.tool-versions.outputs.pnpm }}
 
     - uses: actions/setup-node@v4
       with:
-        node-version: "20"
+        node-version: ${{ steps.tool-versions.outputs.nodejs }}
         cache: "pnpm"
         cache-dependency-path: "${{ inputs.base-path }}/contracts/pnpm-lock.yaml"
 

.github/workflows/changeset.yml

@@ -62,17 +62,24 @@ jobs:
         shell: bash
         run: bash ./.github/scripts/check-changeset-tags.sh ${{ steps.files-changed.outputs.core-changeset_files }}
 
+      - name: Resolve node and pnpm versions
+        if: ${{ steps.files-changed.outputs.core == 'true' || steps.files-changed.outputs.shared == 'true' }}
+        id: tool-versions
+        run: |
+          echo "nodejs=$(go run ./tools/toolversion get nodejs)" >> "${GITHUB_OUTPUT}"
+          echo "pnpm=$(go run ./tools/toolversion get pnpm)" >> "${GITHUB_OUTPUT}"
+
       - name: Setup pnpm
         uses: pnpm/action-setup@a3252b78c470c02df07e9d59298aecedc3ccdd6d # v3.0.0
         if: ${{ steps.files-changed.outputs.core == 'true' || steps.files-changed.outputs.shared == 'true' }}
         with:
-          version: ^10.0.0
+          version: ${{ steps.tool-versions.outputs.pnpm }}
 
       - name: Setup node
         uses: actions/setup-node@v4
         if: ${{ steps.files-changed.outputs.core == 'true' || steps.files-changed.outputs.shared == 'true' }}
         with:
-          node-version: 20
+          node-version: ${{ steps.tool-versions.outputs.nodejs }}
           cache: pnpm
           cache-dependency-path: ./pnpm-lock.yaml
 

.github/workflows/changesets-preview-pr.yml

@@ -29,17 +29,24 @@ jobs:
             core-changeset:
               - '.changeset/**'
 
+      - name: Resolve node and pnpm versions
+        if: steps.change.outputs.core-changeset == 'true'
+        id: tool-versions
+        run: |
+          echo "nodejs=$(go run ./tools/toolversion get nodejs)" >> "${GITHUB_OUTPUT}"
+          echo "pnpm=$(go run ./tools/toolversion get pnpm)" >> "${GITHUB_OUTPUT}"
+
       - name: Setup pnpm
         uses: pnpm/action-setup@a3252b78c470c02df07e9d59298aecedc3ccdd6d # v3.0.0
         if: steps.change.outputs.core-changeset == 'true'
         with:
-          version: ^10.0.0
+          version: ${{ steps.tool-versions.outputs.pnpm }}
 
       - name: Setup node
         uses: actions/setup-node@v4
         if: steps.change.outputs.core-changeset == 'true'
         with:
-          node-version: 20
+          node-version: ${{ steps.tool-versions.outputs.nodejs }}
           cache: pnpm
           cache-dependency-path: ./pnpm-lock.yaml
 

.github/workflows/ci-core.yml

@@ -638,6 +638,10 @@ jobs:
           https://github.com/smartcontractkit/wsrpc/raw/main/cmd/protoc-gen-go-wsrpc/protoc-gen-go-wsrpc
           --output "$HOME/go/bin/protoc-gen-go-wsrpc" && chmod +x
           "$HOME/go/bin/protoc-gen-go-wsrpc"
+      - name: Check tool versions
+        run: |
+          make test-tool-versions
+          make check-tool-versions
       - name: make generate
         run: |
           make rm-mocked

.github/workflows/cre-regression-system-tests.yaml

@@ -193,7 +193,7 @@ jobs:
         shell: bash
         run: |
           echo "::group::Install gotestsum"
-          go install gotest.tools/gotestsum@v1.12.3
+          go run ./tools/toolversion go-install gotest.tools/gotestsum
           echo "::endgroup::"
 
       - name: Resolve Chainlink image

.github/workflows/cre-soak-memory-leak.yml

@@ -114,7 +114,7 @@ jobs:
 
       - name: Install gotestsum
         shell: bash
-        run: go install gotest.tools/gotestsum@v1.12.3
+        run: go run ./tools/toolversion go-install gotest.tools/gotestsum
 
       - name: Run CRE Resource Regression Test
         id: run-soak

.github/workflows/cre-system-tests.yaml

@@ -235,7 +235,7 @@ jobs:
         shell: bash
         run: |
           echo "::group::Install gotestsum"
-          go install gotest.tools/gotestsum@v1.13.0
+          go run ./tools/toolversion go-install gotest.tools/gotestsum
           echo "::endgroup::"
 
       - name: Install Aptos CLI

.github/workflows/cre-wf-caching-test.yml

@@ -116,7 +116,7 @@ jobs:
 
       - name: Install gotestsum
         shell: bash
-        run: go install gotest.tools/gotestsum@v1.12.3
+        run: go run ./tools/toolversion go-install gotest.tools/gotestsum
 
       - name: Run CRE Workflow Caching Test
         id: run-caching

.github/workflows/go-mod-cache.yml

@@ -89,5 +89,5 @@ jobs:
           echo "::endgroup::"
 
           echo "::group::Install testing tools"
-          go install gotest.tools/gotestsum@v1.12.3
+          go run ./tools/toolversion go-install gotest.tools/gotestsum
           echo "::endgroup::"

.tool-versions

@@ -1,4 +1,4 @@
-golang 1.26.3
+golang        1.26.4
 mockery       2.53.0
 nodejs        20.13.1
 pnpm          10.6.5
@@ -7,3 +7,6 @@ helm          3.18.4
 golangci-lint 2.12.2
 protoc        29.3
 python        3.10.5
+k3d           5.4.6
+kubectl       1.25.5
+task          3.35.1

GNUmakefile

@@ -16,9 +16,16 @@ CL_LOOPINSTALL_OUTPUT_DIR ?=
 LOOPINSTALL_PUBLIC_ARGS  := $(if $(strip $(CL_LOOPINSTALL_OUTPUT_DIR)),--output-installation-artifacts $(CL_LOOPINSTALL_OUTPUT_DIR)/public.json)
 LOOPINSTALL_PRIVATE_ARGS := $(if $(strip $(CL_LOOPINSTALL_OUTPUT_DIR)),--output-installation-artifacts $(CL_LOOPINSTALL_OUTPUT_DIR)/private.json)
 LOOPINSTALL_TESTING_ARGS := $(if $(strip $(CL_LOOPINSTALL_OUTPUT_DIR)),--output-installation-artifacts $(CL_LOOPINSTALL_OUTPUT_DIR)/testing.json)
-GOLANGCI_LINT_VERSION = "v2.11.4"
+# Dev tool versions come from the manifests via tools/toolversion, never
+# hardcoded here (see `make check-tool-versions`). Lazy `=` so unrelated targets
+# (e.g. `make chainlink`) don't pay for the parser.
+TOOL_VERSION = go run ./tools/toolversion
+PROTOC_VERSION = $(shell $(TOOL_VERSION) get protoc)
+GOLANGCI_LINT_VERSION = $(shell $(TOOL_VERSION) ref golangci-lint)
 # Pin path so `make generate` does not pick up a different mockery (e.g. v3) from PATH.
-MOCKERY_BIN ?= $(shell GOBIN="$$(go env GOBIN)"; if [ -n "$$GOBIN" ]; then echo "$$GOBIN/mockery"; else echo "$$(go env GOPATH)/bin/mockery"; fi)
+# Honor GOBIN if set, otherwise GOPATH/bin.
+DEV_BIN = $(shell GOBIN="$$(go env GOBIN)"; if [ -n "$$GOBIN" ]; then echo "$$GOBIN"; else echo "$$(go env GOPATH)/bin"; fi)
+MOCKERY_BIN ?= $(DEV_BIN)/mockery
 
 .PHONY: install
 install: install-chainlink-autoinstall ## Install chainlink and all its dependencies.
@@ -33,10 +40,27 @@ install-chainlink-autoinstall: | gomod install-chainlink ## Autoinstall chainlin
 .PHONY: gomod
 gomod: ## Ensure chainlink's go dependencies are installed.
 	@if [ -z "`which gencodec`" ]; then \
-		go install github.com/smartcontractkit/gencodec@latest; \
+		$(TOOL_VERSION) go-install github.com/smartcontractkit/gencodec; \
 	fi || true
 	go mod download
 
+.PHONY: install-dev-tools
+install-dev-tools: ## Install all Go dev tools at pinned versions (works without mise/asdf).
+	$(TOOL_VERSION) go-install mockery
+	$(TOOL_VERSION) go-install github.com/jmank88/gomods
+	$(TOOL_VERSION) go-install github.com/jmank88/modgraph
+	$(TOOL_VERSION) go-install github.com/ugorji/go/codec/codecgen
+	$(TOOL_VERSION) go-install github.com/smartcontractkit/gencodec
+	$(MAKE) protoc-plugins
+
+.PHONY: check-tool-versions
+check-tool-versions: ## Fail if consumers drift from the version manifests.
+	$(TOOL_VERSION) check
+
+.PHONY: test-tool-versions
+test-tool-versions: ## Run toolversion unit tests.
+	go test ./tools/toolversion/...
+
 .PHONY: gomodtidy
 gomodtidy: gomods ## Run go mod tidy on all modules.
 	gomods tidy
@@ -48,7 +72,7 @@ tidy: gomodtidy ## Tidy all modules and add to git.
 
 .PHONY: docs
 docs: ## Install and run pkgsite to view Go docs
-	go install golang.org/x/pkgsite/cmd/pkgsite@latest
+	$(TOOL_VERSION) go-install golang.org/x/pkgsite/cmd/pkgsite
 	# http://localhost:8080/pkg/github.com/smartcontractkit/chainlink/v2/
 	pkgsite
 
@@ -183,7 +207,7 @@ rm-mocked:
 
 .PHONY: testscripts
 testscripts: chainlink-test ## Install and run testscript against testdata/scripts/* files.
-	go install github.com/rogpeppe/go-internal/cmd/testscript@latest
+	$(TOOL_VERSION) go-install github.com/rogpeppe/go-internal/cmd/testscript
 	go run ./tools/txtar/cmd/lstxtardirs -recurse=true | PATH="$(CURDIR):${PATH}" xargs -I % \
 		sh -c 'testscript -e COMMIT_SHA=$(COMMIT_SHA) -e HOME="$(TMPDIR)/home" -e VERSION=$(VERSION) -e VERSION_TAG=$(VERSION_TAG) $(TS_FLAGS) %/*.txtar'
 
@@ -213,7 +237,7 @@ testdb-user-only: ## Prepares the test database with user only.
 
 .PHONY: gomods
 gomods: ## Install gomods
-	go install github.com/jmank88/gomods@v0.1.7
+	$(TOOL_VERSION) go-install github.com/jmank88/gomods
 
 .PHONY: gomodslocalupdate
 gomodslocalupdate: gomods ## Run gomod-local-update
@@ -223,15 +247,19 @@ gomodslocalupdate: gomods ## Run gomod-local-update
 
 .PHONY: mockery
 mockery: $(mockery) ## Install mockery.
-	go install github.com/vektra/mockery/v2@v2.53.0
+	$(TOOL_VERSION) go-install mockery
 
 .PHONY: codecgen
 codecgen: $(codecgen) ## Install codecgen
-	go install github.com/ugorji/go/codec/codecgen@v1.2.10
+	$(TOOL_VERSION) go-install github.com/ugorji/go/codec/codecgen
 
 .PHONY: protoc
 protoc: ## Install protoc
-	core/scripts/install-protoc.sh 29.3 /
+	core/scripts/install-protoc.sh $(PROTOC_VERSION) /
+	$(MAKE) protoc-plugins
+
+.PHONY: protoc-plugins
+protoc-plugins: ## Install protoc plugins (versions tracked by go.mod, not the manifests).
 	go install google.golang.org/protobuf/cmd/protoc-gen-go@`go list -m -json google.golang.org/protobuf | jq -r .Version`
 	go install github.com/smartcontractkit/wsrpc/cmd/protoc-gen-go-wsrpc@`go list -m -json github.com/smartcontractkit/wsrpc | jq -r .Version`
 
@@ -263,7 +291,7 @@ lint-fix: gomods ## Run golangci-lint with --fix for all modules
 
 .PHONY: modgraph
 modgraph:
-	go install github.com/jmank88/modgraph@v0.1.4
+	$(TOOL_VERSION) go-install github.com/jmank88/modgraph
 	./tools/bin/modgraph > go.md
 
 .PHONY: test-short

core/chainlink.Dockerfile

@@ -35,7 +35,9 @@ COPY . .
 
 # Stage: Delve debugger (no source needed, branches from deps-base)
 FROM deps-base AS build-delve
-RUN go install github.com/go-delve/delve/cmd/dlv@v1.24.2
+COPY .tool-versions tools/go-tools.txt ./
+COPY tools/toolversion ./tools/toolversion
+RUN go run ./tools/toolversion go-install github.com/go-delve/delve/cmd/dlv
 
 # Stage: Remote plugins — only manifest YAMLs, no source tree.
 # Cached as long as go.mod/go.sum and plugin manifests are unchanged,