gRPC client-only Go module
kas depends on the Gitaly Go module to fetch files. Naturally, this brings all of Gitaly's dependencies into scope. There have been some recent examples why this is problematic:
- https://gitlab.com/gitlab-org/cluster-integration/gitlab-agent/-/issues/397 vulnerability in a transitive dependency that comes via Gitaly/LabKit.
- Somewhat related: !5730 (merged). Wanted to bump gRPC to a newer version, but Gitaly used a package that was no longer available.
- Somewhat related: labkit!175 (comment 1375938790). Gitaly depends on LabKit and kas/agentk only depend on it transitively. This also brings lots of unwanted dependencies.
To summarize, as a Gitaly client user I'd greatly appreciate if it was a separate Go module without any extra dependencies that are not strictly necessary for a client program. I.e. no LabKit, no Gitaly server-side dependencies. What is needed is only protobufs, client constructor, client pool, client authn/credentials helper, backoff, dns resolver.
Any interest in supporting this? I'm considering copying/vendoring all the things I need and dropping the dependency on Gitaly to reduce the dependency sprawl. This is somewhat similar to what Gitaly team did in !4819 (merged), which I was happy to see (fewer transitive dependencies I don't actually need).