fix(rest-api): pin workflow-schema protobuf plugins to CI versions

[osu]

Summary

• Pin rest-api/workflow-schema/buf.gen.yaml to buf remote plugins matching CI (protoc-gen-go@v1.36.11, protoc-gen-go-grpc@v1.6.1)
• Prevents local regeneration with a newer PATH-installed protoc-gen-go-grpc (e.g. v1.6.2) from failing Check REST Core Proto Sync and Check Protobuf Generated Code

Context

Those checks only rewrite version header comments in a few *_grpc.pb.go files when plugin versions drift. Main already has the correct v1.6.1 headers from #2586; this change stops the drift from recurring.

Test plan

• make -C rest-api core-proto followed by scripts/check-repo-clean.sh "REST Core protobuf sync"
• REST CI Check Protobuf Generated Code passes

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 7d6aacbd-ea51-43c7-babc-53e3b9ba6b71

📥 Commits

Reviewing files that changed from the base of the PR and between af47612 and 082d6d4.

📒 Files selected for processing (1)

• rest-api/workflow-schema/buf.gen.yaml

---

Summary by CodeRabbit

• Chores
  • Updated the API generation configuration to the latest format and switched to remote plugin references, keeping output locations unchanged.

Walkthrough

The buf.gen.yaml configuration file is updated from version: v1 to version: v2. Plugin definitions are migrated from local name-based references to remote-based plugin endpoints for both Go and gRPC generation. Output directory and paths=source_relative options remain unchanged.

Buf Generation Config Update

Layer / File(s)	Summary
buf.gen.yaml v1 to v2 migration rest-api/workflow-schema/buf.gen.yaml	Version field updated to v2; name-based plugin entries replaced with remote plugin references for Go and gRPC, retaining existing output path and paths=source_relative option.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~2 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly summarizes the main change: pinning workflow-schema protobuf plugins to CI versions.
Description check	✅ Passed	The description is directly related to the change and explains the version pinning and its motivation.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

🔍 Container Scan Summary

Service	Total	Critical	High	Medium	Low	Other
nico-flow	43	3	21	9	2	8
nico-nsm	49	0	10	31	8	0
nico-psm	43	3	21	9	2	8
nico-rest-api	43	3	21	9	2	8
nico-rest-cert-manager	42	3	21	9	1	8
nico-rest-db	43	3	21	9	2	8
nico-rest-site-agent	42	3	21	9	1	8
nico-rest-site-manager	42	3	21	9	1	8
nico-rest-workflow	43	3	21	9	2	8
TOTAL	390	24	178	103	21	64

Per-CVE detail lives in the per-service grype-* artifacts (JSON + SARIF). Severity counts only — no CVE IDs published here.

[github-actions]

🔐 TruffleHog Secret Scan

✅ No secrets or credentials found!

Your code has been scanned for 700+ types of secrets and credentials. All clear! 🎉

🔗 View scan details

_{🕐 Last updated: 2026-06-29 19:24:13 UTC | Commit: 082d6d4}

[hwadekar-nv]

Thanks @kfelternv @thossain-nv , this would definitely help to prevent local regeneration to match CI