@@ -4,7 +4,7 @@ on:
   push:
     branches: [ master ]
     paths:
-      - 'gcp/api/v1/osv_service_v1.proto'
+      - 'proto/v1/osv_service_v1.proto'
       - 'osv/importfinding.proto'
       - 'osv/osv-schema/proto/vulnerability.proto'
   workflow_dispatch:
@@ -41,9 +41,7 @@ jobs:
         run: pip install poetry==2.3.3
 
       - name: Set up poetry
-        run: |
-          poetry install
-          cd gcp/api && poetry install
+        run: poetry install
 
       - name: Set up Go
         uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
 
@@ -15,7 +15,6 @@ build/lib
 hurl-scripts/
 temp/*
 **/tmp/**
-gcp/api/v1/osv/**
 .hypothesis
 go/api-devserver
 go/api
 
@@ -1,6 +1,3 @@
-[submodule "gcp/api/googleapis"]
-	path = gcp/api/googleapis
-	url = https://github.com/googleapis/googleapis
 [submodule "docker/worker/osv-test"]
 	path = gcp/workers/worker/osv-test
 	url = https://github.com/oliverchang/osv-test.git
 
@@ -250,7 +250,7 @@ Contains deployment setups, workers running in GKE, Cloud Functions, and the use
 - **Status**: **Active (Go)**.
 - Serves the public OSV gRPC API server (transcoded to HTTP/JSON REST via ESPv2).
 - **Deployment Target**: **Google Cloud Run** (managed via Cloud Deploy pipeline `osv-api` deploying to `osv-grpc-backend`).
-- *Note*: Fully migrated from Python to Go. The legacy Python implementation remains in `gcp/api/` but is retired.
+- *Note*: Fully migrated from Python to Go. Protobuf definitions and descriptor files are located under `proto/v1/`.
 
 ### 2. Website (`gcp/website/`)
 - **Status**: **Active**.
 
@@ -44,17 +44,10 @@ go-tests: ## Run Go services tests
 	cd go && ./run_tests.sh
 
 api-server-tests: ## Run Go API server integration tests
-	test -f $(HOME)/.config/gcloud/application_default_credentials.json || (echo "GCP Application Default Credentials not set, try 'gcloud auth application-default login'"; exit 1)
-	cd go && go build -o ./api ./cmd/api
-	cd gcp/api && docker build -f Dockerfile.esp -t osv/esp:latest .
-	cd gcp/api && OSV_USE_GO_BACKEND=1 ./run_tests.sh $(HOME)/.config/gcloud/application_default_credentials.json
-	cd gcp/api && OSV_USE_GO_BACKEND=1 ./run_tests_e2e.sh $(HOME)/.config/gcloud/application_default_credentials.json
+	./tools/apitester/run_tests.sh
 
 update-api-snapshots: ## Update API query snapshots
-	test -f $(HOME)/.config/gcloud/application_default_credentials.json || (echo "GCP Application Default Credentials not set, try 'gcloud auth application-default login'"; exit 1)
-	cd go && go build -o ./api ./cmd/api
-	cd gcp/api && docker build -f Dockerfile.esp -t osv/esp:latest .
-	cd gcp/api && UPDATE_SNAPS=true OSV_USE_GO_BACKEND=1 ./run_tests_e2e.sh $(HOME)/.config/gcloud/application_default_credentials.json
+	UPDATE_SNAPS=true ./tools/apitester/run_tests.sh
 
 lint: ## Run linters and format checks
 	GOTOOLCHAIN=auto $(run-cmd) tools/lint_and_format.sh
@@ -63,33 +56,33 @@ build-osv-protos:
 	cd osv && $(run-cmd) python -m grpc_tools.protoc --python_out=. --mypy_out=. --proto_path=. --proto_path=osv-schema/proto vulnerability.proto importfinding.proto
 
 build-api-protos:
-	cd gcp/api/v1 && $(run-cmd) python -m grpc_tools.protoc \
+	cd proto/v1 && protoc \
       --include_imports \
       --include_source_info \
-      --proto_path=googleapis \
+      --proto_path=.. \
       --proto_path=. \
-      --proto_path=osv \
-      --proto_path=osv/osv-schema/proto \
+      --proto_path=../../osv \
+      --proto_path=../../osv/osv-schema/proto \
       --descriptor_set_out=api_descriptor.pb \
-      --python_out=.. \
-      --grpc_python_out=.. \
-      --mypy_out=.. \
       vulnerability.proto importfinding.proto osv_service_v1.proto
 	cd osv && protoc \
       --proto_path=. \
       --go_out=paths=source_relative:../bindings/go/api \
       importfinding.proto
-	cd gcp/api/v1 && protoc \
-      --proto_path=googleapis \
+	cd proto/v1 && protoc \
+      --proto_path=.. \
       --proto_path=. \
-      --proto_path=osv \
-      --proto_path=osv/osv-schema/proto \
-      --go_out=paths=source_relative:../../../bindings/go/api \
-      --go-grpc_out=paths=source_relative:../../../bindings/go/api \
+      --proto_path=../../osv \
+      --proto_path=../../osv/osv-schema/proto \
+      --go_out=paths=source_relative:../../bindings/go/api \
+      --go-grpc_out=paths=source_relative:../../bindings/go/api \
       osv_service_v1.proto
 
 build-protos: build-osv-protos build-api-protos ## Build all protocol buffers
 
+build-swagger: ## Build Swagger/OpenAPI documentation
+	./docs/build_swagger.sh
+
 build-website-frontend:
 	cd website/frontend3 && pnpm install && pnpm run build
 	cd website/blog && hugo --buildFuture -d ../dist/static/blog
@@ -127,26 +120,15 @@ run-go-website-prod: stage-website-assets
 # Run with `make run-api-server ARGS=--no-backend` to launch esp without backend.
 run-api-server: ## Run local Go API server with ESPv2 proxy
 	test -f $(HOME)/.config/gcloud/application_default_credentials.json || (echo "GCP Application Default Credentials not set, try 'gcloud auth application-default login'"; exit 1)
-	docker inspect osv/esp:latest >/dev/null 2>&1 || (cd gcp/api && docker build -f Dockerfile.esp -t osv/esp:latest .)
+	docker inspect osv/esp:latest >/dev/null 2>&1 || docker build -f docker/esp/Dockerfile -t osv/esp:latest docker/esp
 	@cd go && go build -o ./api-devserver ./cmd/api-devserver && (GOOGLE_CLOUD_PROJECT=oss-vdb OSV_VULNERABILITIES_BUCKET=osv-vulnerabilities ./api-devserver $(ARGS); EXIT_CODE=$$?; rm -f ./api-devserver; exit $$EXIT_CODE)
 
 # Run the Go developer server orchestrator against the staging/test environment.
 run-api-server-test:
 	test -f $(HOME)/.config/gcloud/application_default_credentials.json || (echo "GCP Application Default Credentials not set, try 'gcloud auth application-default login'"; exit 1)
-	docker inspect osv/esp:latest >/dev/null 2>&1 || (cd gcp/api && docker build -f Dockerfile.esp -t osv/esp:latest .)
+	docker inspect osv/esp:latest >/dev/null 2>&1 || docker build -f docker/esp/Dockerfile -t osv/esp:latest docker/esp
 	@cd go && go build -o ./api-devserver ./cmd/api-devserver && (GOOGLE_CLOUD_PROJECT=oss-vdb-test OSV_VULNERABILITIES_BUCKET=osv-test-vulnerabilities ./api-devserver $(ARGS); EXIT_CODE=$$?; rm -f ./api-devserver; exit $$EXIT_CODE)
 
-# Legacy Python API server targets
-run-python-api-server:
-	test -f $(HOME)/.config/gcloud/application_default_credentials.json || (echo "GCP Application Default Credentials not set, try 'gcloud auth application-default login'"; exit 1)
-	cd gcp/api && docker build -f Dockerfile.esp -t osv/esp:latest .
-	cd gcp/api && $(install-cmd) && GOOGLE_CLOUD_PROJECT=oss-vdb OSV_VULNERABILITIES_BUCKET=osv-vulnerabilities $(run-cmd) python test_server.py $(HOME)/.config/gcloud/application_default_credentials.json $(ARGS)
-
-run-python-api-server-test:
-	test -f $(HOME)/.config/gcloud/application_default_credentials.json || (echo "GCP Application Default Credentials not set, try 'gcloud auth application-default login'"; exit 1)
-	cd gcp/api && docker build -f Dockerfile.esp -t osv/esp:latest .
-	cd gcp/api && $(install-cmd) && GOOGLE_CLOUD_PROJECT=oss-vdb-test OSV_VULNERABILITIES_BUCKET=osv-test-vulnerabilities $(run-cmd) python test_server.py $(HOME)/.config/gcloud/application_default_credentials.json $(ARGS)
-
 # TODO: API integration tests.
 all-tests: lib-tests worker-tests importer-tests recoverer-tests website-tests vulnfeed-tests bindings-tests go-tests ## Run all tests
 
 
@@ -38,9 +38,8 @@ consists of:
 |-----------------|------|
 | `bindings/`     | Language bindings for the [OSV API](https://google.github.io/osv.dev/api/) (currently Go only) |
 | `deployment/`   | Terraform & Cloud Deploy config files <br /> A few Cloud Build config yamls |
-| `docker/`       | CI docker files (`ci`, `deployment`, `terraform`) <br /> `worker-base` docker image for `gcp/workers/worker` |
-| `docs/`         | Jekyll files for https://google.github.io/osv.dev/ <br /> `build_swagger.py` and `tools.go` |
-| `gcp/api`       | OSV API server files (including files for the local ESP server) <br /> protobuf files in `/v1`|
+| `docker/`       | CI docker files (`ci`, `deployment`, `terraform`, `esp`) <br /> `worker-base` docker image for `gcp/workers/worker` |
+| `docs/`         | Jekyll files for https://google.github.io/osv.dev/ <br /> `build_swagger.sh` and `tools.go` |
 | `gcp/datastore` | The datastore index file (`index.yaml`) |
 | `gcp/functions` | The Cloud Function for publishing PyPI vulnerabilities (maintained, but not developed) |
 | `gcp/indexer`   | The determine version `indexer` |
 
@@ -32,11 +32,6 @@ steps:
   args: ['gcloud', 'builds', 'submit', '--region=${LOCATION}', '--config=gcp/website/cloudbuild.yaml', '.']
   waitFor: ['init']
 
-- name: 'gcr.io/google.com/cloudsdktool/cloud-sdk:slim'
-  id: 'api-tests'
-  args: ['gcloud', 'builds', 'submit', '--region=${LOCATION}', '--config=gcp/api/cloudbuild.yaml', '.']
-  waitFor: ['init']
-
 - name: 'gcr.io/google.com/cloudsdktool/cloud-sdk:slim'
   id: 'vulnfeeds-tests'
   args: ['gcloud', 'builds', 'submit', '--region=${LOCATION}', '--config=vulnfeeds/cloudbuild.yaml', '.']