Non-deterministic file dependencies

[haines]

GitHub repository with your minimal reproducible example (do not leave this field blank or fill out this field with "github.com/bufbuild/buf" or we will automatically close your issue, see the instructions above!)

https://github.com/haines/buf-dependencies-flapping

Commands

# Runs `buf generate` repeatedly until a diff is produced
./repro

Output

.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
diff --git a/src/cerbos/policy/v1/policy_pb.ts b/src/cerbos/policy/v1/policy_pb.ts
index 3d8c9e5..b51cbe6 100644
--- a/src/cerbos/policy/v1/policy_pb.ts
+++ b/src/cerbos/policy/v1/policy_pb.ts
@@ -13,13 +13,14 @@ import type { OutputEntry, OutputEntryJson, Trace, TraceJson } from "../../engin
 import { file_cerbos_engine_v1_engine } from "../../engine/v1/engine_pb.js";
 import type { Value, ValueJson } from "@bufbuild/protobuf/wkt";
 import { file_google_protobuf_struct } from "@bufbuild/protobuf/wkt";
+import { file_protoc_gen_openapiv2_options_annotations } from "../../../protoc-gen-openapiv2/options/annotations_pb.js";
 import type { Message } from "@bufbuild/protobuf";
 
 /**
  * Describes the file cerbos/policy/v1/policy.proto.
  */
 export const file_cerbos_policy_v1_policy: GenFile = /*@__PURE__*/
-  fileDesc("Ch1jZXJib3MvcG9saWN5L3YxL3BvbGljeS5wcm90bxIQY2VyYm9zLnBvbGljeS52MSK7DwoLVGVzdFJlc3VsdHMSMwoGc3VpdGVzGAEgAygLMiMuY2VyYm9zLnBvbGljeS52MS5UZXN0UmVzdWx0cy5TdWl0ZRI2CgdzdW1tYXJ5GAIgASgLMiUuY2VyYm9zLnBvbGljeS52MS5UZXN0UmVzdWx0cy5TdW1tYXJ5GkwKBVRhbGx5EjQKBnJlc3VsdBgBIAEoDjIkLmNlcmJvcy5wb2xpY3kudjEuVGVzdFJlc3VsdHMuUmVzdWx0Eg0KBWNvdW50GAIgASgNGpgBCgdTdW1tYXJ5EjwKDm92ZXJhbGxfcmVzdWx0GAEgASgOMiQuY2VyYm9zLnBvbGljeS52MS5UZXN0UmVzdWx0cy5SZXN1bHQSEwoLdGVzdHNfY291bnQYAiABKA0SOgoNcmVzdWx0X2NvdW50cxgDIAMoCzIjLmNlcmJvcy5wb2xpY3kudjEuVGVzdFJlc3VsdHMuVGFsbHkakQIKBVN1aXRlEgwKBGZpbGUYASABKAkSDAoEbmFtZRgCIAEoCRI/CgpwcmluY2lwYWxzGAMgAygLMicuY2VyYm9zLnBvbGljeS52MS5UZXN0UmVzdWx0cy5QcmluY2lwYWxCAhgBEjYKB3N1bW1hcnkYBCABKAsyJS5jZXJib3MucG9saWN5LnYxLlRlc3RSZXN1bHRzLlN1bW1hcnkSDQoFZXJyb3IYBSABKAkSOgoKdGVzdF9jYXNlcxgGIAMoCzImLmNlcmJvcy5wb2xpY3kudjEuVGVzdFJlc3VsdHMuVGVzdENhc2USEwoLZGVzY3JpcHRpb24YByABKAkSEwoLc2tpcF9yZWFzb24YCCABKAkaVQoIVGVzdENhc2USDAoEbmFtZRgBIAEoCRI7CgpwcmluY2lwYWxzGAIgAygLMicuY2VyYm9zLnBvbGljeS52MS5UZXN0UmVzdWx0cy5QcmluY2lwYWwaVAoJUHJpbmNpcGFsEgwKBG5hbWUYASABKAkSOQoJcmVzb3VyY2VzGAIgAygLMiYuY2VyYm9zLnBvbGljeS52MS5UZXN0UmVzdWx0cy5SZXNvdXJjZRpPCghSZXNvdXJjZRIMCgRuYW1lGAEgASgJEjUKB2FjdGlvbnMYAiADKAsyJC5jZXJib3MucG9saWN5LnYxLlRlc3RSZXN1bHRzLkFjdGlvbhpOCgZBY3Rpb24SDAoEbmFtZRgBIAEoCRI2CgdkZXRhaWxzGAIgASgLMiUuY2VyYm9zLnBvbGljeS52MS5UZXN0UmVzdWx0cy5EZXRhaWxzGpUCCgdEZXRhaWxzEjQKBnJlc3VsdBgBIAEoDjIkLmNlcmJvcy5wb2xpY3kudjEuVGVzdFJlc3VsdHMuUmVzdWx0EjgKB2ZhaWx1cmUYAiABKAsyJS5jZXJib3MucG9saWN5LnYxLlRlc3RSZXN1bHRzLkZhaWx1cmVIABIPCgVlcnJvchgDIAEoCUgAEjgKB3N1Y2Nlc3MYBSABKAsyJS5jZXJib3MucG9saWN5LnYxLlRlc3RSZXN1bHRzLlN1Y2Nlc3NIABIVCgtza2lwX3JlYXNvbhgGIAEoCUgAEi0KDGVuZ2luZV90cmFjZRgEIAMoCzIXLmNlcmJvcy5lbmdpbmUudjEuVHJhY2VCCQoHb3V0Y29tZRrmAgoNT3V0cHV0RmFpbHVyZRILCgNzcmMYASABKAkSUQoKbWlzbWF0Y2hlZBgCIAEoCzI7LmNlcmJvcy5wb2xpY3kudjEuVGVzdFJlc3VsdHMuT3V0cHV0RmFpbHVyZS5NaXNtYXRjaGVkVmFsdWVIABJLCgdtaXNzaW5nGAMgASgLMjguY2VyYm9zLnBvbGljeS52MS5UZXN0UmVzdWx0cy5PdXRwdXRGYWlsdXJlLk1pc3NpbmdWYWx1ZUgAGmMKD01pc21hdGNoZWRWYWx1ZRIoCghleHBlY3RlZBgBIAEoCzIWLmdvb2dsZS5wcm90b2J1Zi5WYWx1ZRImCgZhY3R1YWwYAiABKAsyFi5nb29nbGUucHJvdG9idWYuVmFsdWUaOAoMTWlzc2luZ1ZhbHVlEigKCGV4cGVjdGVkGAEgASgLMhYuZ29vZ2xlLnByb3RvYnVmLlZhbHVlQgkKB291dGNvbWUanQEKB0ZhaWx1cmUSKgoIZXhwZWN0ZWQYASABKA4yGC5jZXJib3MuZWZmZWN0LnYxLkVmZmVjdBIoCgZhY3R1YWwYAiABKA4yGC5jZXJib3MuZWZmZWN0LnYxLkVmZmVjdBI8CgdvdXRwdXRzGAMgAygLMisuY2VyYm9zLnBvbGljeS52MS5UZXN0UmVzdWx0cy5PdXRwdXRGYWlsdXJlGmMKB1N1Y2Nlc3MSKAoGZWZmZWN0GAEgASgOMhguY2VyYm9zLmVmZmVjdC52MS5FZmZlY3QSLgoHb3V0cHV0cxgCIAMoCzIdLmNlcmJvcy5lbmdpbmUudjEuT3V0cHV0RW50cnkibgoGUmVzdWx0EhYKElJFU1VMVF9VTlNQRUNJRklFRBAAEhIKDlJFU1VMVF9TS0lQUEVEEAESEQoNUkVTVUxUX1BBU1NFRBACEhEKDVJFU1VMVF9GQUlMRUQQAxISCg5SRVNVTFRfRVJST1JFRBAEQm8KGGRldi5jZXJib3MuYXBpLnYxLnBvbGljeVo8Z2l0aHViLmNvbS9jZXJib3MvY2VyYm9zL2FwaS9nZW5wYi9jZXJib3MvcG9saWN5L3YxO3BvbGljeXYxqgIUQ2VyYm9zLkFwaS5WMS5Qb2xpY3liBnByb3RvMw", [file_cerbos_effect_v1_effect, file_cerbos_engine_v1_engine, file_google_protobuf_struct]);
+  fileDesc("Ch1jZXJib3MvcG9saWN5L3YxL3BvbGljeS5wcm90bxIQY2VyYm9zLnBvbGljeS52MSK7DwoLVGVzdFJlc3VsdHMSMwoGc3VpdGVzGAEgAygLMiMuY2VyYm9zLnBvbGljeS52MS5UZXN0UmVzdWx0cy5TdWl0ZRI2CgdzdW1tYXJ5GAIgASgLMiUuY2VyYm9zLnBvbGljeS52MS5UZXN0UmVzdWx0cy5TdW1tYXJ5GkwKBVRhbGx5EjQKBnJlc3VsdBgBIAEoDjIkLmNlcmJvcy5wb2xpY3kudjEuVGVzdFJlc3VsdHMuUmVzdWx0Eg0KBWNvdW50GAIgASgNGpgBCgdTdW1tYXJ5EjwKDm92ZXJhbGxfcmVzdWx0GAEgASgOMiQuY2VyYm9zLnBvbGljeS52MS5UZXN0UmVzdWx0cy5SZXN1bHQSEwoLdGVzdHNfY291bnQYAiABKA0SOgoNcmVzdWx0X2NvdW50cxgDIAMoCzIjLmNlcmJvcy5wb2xpY3kudjEuVGVzdFJlc3VsdHMuVGFsbHkakQIKBVN1aXRlEgwKBGZpbGUYASABKAkSDAoEbmFtZRgCIAEoCRI/CgpwcmluY2lwYWxzGAMgAygLMicuY2VyYm9zLnBvbGljeS52MS5UZXN0UmVzdWx0cy5QcmluY2lwYWxCAhgBEjYKB3N1bW1hcnkYBCABKAsyJS5jZXJib3MucG9saWN5LnYxLlRlc3RSZXN1bHRzLlN1bW1hcnkSDQoFZXJyb3IYBSABKAkSOgoKdGVzdF9jYXNlcxgGIAMoCzImLmNlcmJvcy5wb2xpY3kudjEuVGVzdFJlc3VsdHMuVGVzdENhc2USEwoLZGVzY3JpcHRpb24YByABKAkSEwoLc2tpcF9yZWFzb24YCCABKAkaVQoIVGVzdENhc2USDAoEbmFtZRgBIAEoCRI7CgpwcmluY2lwYWxzGAIgAygLMicuY2VyYm9zLnBvbGljeS52MS5UZXN0UmVzdWx0cy5QcmluY2lwYWwaVAoJUHJpbmNpcGFsEgwKBG5hbWUYASABKAkSOQoJcmVzb3VyY2VzGAIgAygLMiYuY2VyYm9zLnBvbGljeS52MS5UZXN0UmVzdWx0cy5SZXNvdXJjZRpPCghSZXNvdXJjZRIMCgRuYW1lGAEgASgJEjUKB2FjdGlvbnMYAiADKAsyJC5jZXJib3MucG9saWN5LnYxLlRlc3RSZXN1bHRzLkFjdGlvbhpOCgZBY3Rpb24SDAoEbmFtZRgBIAEoCRI2CgdkZXRhaWxzGAIgASgLMiUuY2VyYm9zLnBvbGljeS52MS5UZXN0UmVzdWx0cy5EZXRhaWxzGpUCCgdEZXRhaWxzEjQKBnJlc3VsdBgBIAEoDjIkLmNlcmJvcy5wb2xpY3kudjEuVGVzdFJlc3VsdHMuUmVzdWx0EjgKB2ZhaWx1cmUYAiABKAsyJS5jZXJib3MucG9saWN5LnYxLlRlc3RSZXN1bHRzLkZhaWx1cmVIABIPCgVlcnJvchgDIAEoCUgAEjgKB3N1Y2Nlc3MYBSABKAsyJS5jZXJib3MucG9saWN5LnYxLlRlc3RSZXN1bHRzLlN1Y2Nlc3NIABIVCgtza2lwX3JlYXNvbhgGIAEoCUgAEi0KDGVuZ2luZV90cmFjZRgEIAMoCzIXLmNlcmJvcy5lbmdpbmUudjEuVHJhY2VCCQoHb3V0Y29tZRrmAgoNT3V0cHV0RmFpbHVyZRILCgNzcmMYASABKAkSUQoKbWlzbWF0Y2hlZBgCIAEoCzI7LmNlcmJvcy5wb2xpY3kudjEuVGVzdFJlc3VsdHMuT3V0cHV0RmFpbHVyZS5NaXNtYXRjaGVkVmFsdWVIABJLCgdtaXNzaW5nGAMgASgLMjguY2VyYm9zLnBvbGljeS52MS5UZXN0UmVzdWx0cy5PdXRwdXRGYWlsdXJlLk1pc3NpbmdWYWx1ZUgAGmMKD01pc21hdGNoZWRWYWx1ZRIoCghleHBlY3RlZBgBIAEoCzIWLmdvb2dsZS5wcm90b2J1Zi5WYWx1ZRImCgZhY3R1YWwYAiABKAsyFi5nb29nbGUucHJvdG9idWYuVmFsdWUaOAoMTWlzc2luZ1ZhbHVlEigKCGV4cGVjdGVkGAEgASgLMhYuZ29vZ2xlLnByb3RvYnVmLlZhbHVlQgkKB291dGNvbWUanQEKB0ZhaWx1cmUSKgoIZXhwZWN0ZWQYASABKA4yGC5jZXJib3MuZWZmZWN0LnYxLkVmZmVjdBIoCgZhY3R1YWwYAiABKA4yGC5jZXJib3MuZWZmZWN0LnYxLkVmZmVjdBI8CgdvdXRwdXRzGAMgAygLMisuY2VyYm9zLnBvbGljeS52MS5UZXN0UmVzdWx0cy5PdXRwdXRGYWlsdXJlGmMKB1N1Y2Nlc3MSKAoGZWZmZWN0GAEgASgOMhguY2VyYm9zLmVmZmVjdC52MS5FZmZlY3QSLgoHb3V0cHV0cxgCIAMoCzIdLmNlcmJvcy5lbmdpbmUudjEuT3V0cHV0RW50cnkibgoGUmVzdWx0EhYKElJFU1VMVF9VTlNQRUNJRklFRBAAEhIKDlJFU1VMVF9TS0lQUEVEEAESEQoNUkVTVUxUX1BBU1NFRBACEhEKDVJFU1VMVF9GQUlMRUQQAxISCg5SRVNVTFRfRVJST1JFRBAEQm8KGGRldi5jZXJib3MuYXBpLnYxLnBvbGljeVo8Z2l0aHViLmNvbS9jZXJib3MvY2VyYm9zL2FwaS9nZW5wYi9jZXJib3MvcG9saWN5L3YxO3BvbGljeXYxqgIUQ2VyYm9zLkFwaS5WMS5Qb2xpY3liBnByb3RvMw", [file_cerbos_effect_v1_effect, file_cerbos_engine_v1_engine, file_google_protobuf_struct, file_protoc_gen_openapiv2_options_annotations]);
 
 /**
  * @generated from message cerbos.policy.v1.TestResults

Expected Output

No diff when running buf generate repeatedly.

Anything else?

There are a couple of file dependencies that do not seem to be deterministically added to the fileDesc call in the protobuf-es output. It seems to be dependencies used for annotations (file_buf_validate_validate, file_protoc_gen_openapiv2_options_annotations).

This appears to have been introduced in v1.51.0; v1.50.1 does not suffer from the issue.

Similar issue observed previously: #3506

[emcfarlane]

Thanks for detailed issue and repro! Fixed the issue. Will go out in the next release.