chore: remove Python API code

.github/workflows/generate-protos.yml

@@ -4,7 +4,7 @@ on:
   push:
     branches: [ master ]
     paths:
-      - 'gcp/api/v1/osv_service_v1.proto'
+      - 'proto/v1/osv_service_v1.proto'
       - 'osv/importfinding.proto'
       - 'osv/osv-schema/proto/vulnerability.proto'
   workflow_dispatch:
@@ -41,9 +41,7 @@ jobs:
         run: pip install poetry==2.3.3
 
       - name: Set up poetry
-        run: |
-          poetry install
-          cd gcp/api && poetry install
+        run: poetry install
 
       - name: Set up Go
         uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0

.gitignore

@@ -15,7 +15,6 @@ build/lib
 hurl-scripts/
 temp/*
 **/tmp/**
-gcp/api/v1/osv/**
 .hypothesis
 go/api-devserver
 go/api

.gitmodules

@@ -1,6 +1,3 @@
-[submodule "gcp/api/googleapis"]
-	path = gcp/api/googleapis
-	url = https://github.com/googleapis/googleapis
 [submodule "docker/worker/osv-test"]
 	path = gcp/workers/worker/osv-test
 	url = https://github.com/oliverchang/osv-test.git

AGENTS.md

@@ -250,7 +250,7 @@ Contains deployment setups, workers running in GKE, Cloud Functions, and the use
 - **Status**: **Active (Go)**.
 - Serves the public OSV gRPC API server (transcoded to HTTP/JSON REST via ESPv2).
 - **Deployment Target**: **Google Cloud Run** (managed via Cloud Deploy pipeline `osv-api` deploying to `osv-grpc-backend`).
-- *Note*: Fully migrated from Python to Go. The legacy Python implementation remains in `gcp/api/` but is retired.
+- *Note*: Fully migrated from Python to Go. Protobuf definitions and descriptor files are located under `proto/v1/`.
 
 ### 2. Website (`gcp/website/`)
 - **Status**: **Active**.

Makefile

@@ -44,17 +44,10 @@ go-tests: ## Run Go services tests
 	cd go && ./run_tests.sh
 
 api-server-tests: ## Run Go API server integration tests
-	test -f $(HOME)/.config/gcloud/application_default_credentials.json || (echo "GCP Application Default Credentials not set, try 'gcloud auth application-default login'"; exit 1)
-	cd go && go build -o ./api ./cmd/api
-	cd gcp/api && docker build -f Dockerfile.esp -t osv/esp:latest .
-	cd gcp/api && OSV_USE_GO_BACKEND=1 ./run_tests.sh $(HOME)/.config/gcloud/application_default_credentials.json
-	cd gcp/api && OSV_USE_GO_BACKEND=1 ./run_tests_e2e.sh $(HOME)/.config/gcloud/application_default_credentials.json
+	./tools/apitester/run_tests.sh
 
 update-api-snapshots: ## Update API query snapshots
-	test -f $(HOME)/.config/gcloud/application_default_credentials.json || (echo "GCP Application Default Credentials not set, try 'gcloud auth application-default login'"; exit 1)
-	cd go && go build -o ./api ./cmd/api
-	cd gcp/api && docker build -f Dockerfile.esp -t osv/esp:latest .
-	cd gcp/api && UPDATE_SNAPS=true OSV_USE_GO_BACKEND=1 ./run_tests_e2e.sh $(HOME)/.config/gcloud/application_default_credentials.json
+	UPDATE_SNAPS=true ./tools/apitester/run_tests.sh
 
 lint: ## Run linters and format checks
 	GOTOOLCHAIN=auto $(run-cmd) tools/lint_and_format.sh
@@ -63,33 +56,33 @@ build-osv-protos:
 	cd osv && $(run-cmd) python -m grpc_tools.protoc --python_out=. --mypy_out=. --proto_path=. --proto_path=osv-schema/proto vulnerability.proto importfinding.proto
 
 build-api-protos:
-	cd gcp/api/v1 && $(run-cmd) python -m grpc_tools.protoc \
+	cd proto/v1 && protoc \
       --include_imports \
       --include_source_info \
-      --proto_path=googleapis \
+      --proto_path=.. \
       --proto_path=. \
-      --proto_path=osv \
-      --proto_path=osv/osv-schema/proto \
+      --proto_path=../../osv \
+      --proto_path=../../osv/osv-schema/proto \
       --descriptor_set_out=api_descriptor.pb \
-      --python_out=.. \
-      --grpc_python_out=.. \
-      --mypy_out=.. \
       vulnerability.proto importfinding.proto osv_service_v1.proto
 	cd osv && protoc \
       --proto_path=. \
       --go_out=paths=source_relative:../bindings/go/api \
       importfinding.proto
-	cd gcp/api/v1 && protoc \
-      --proto_path=googleapis \
+	cd proto/v1 && protoc \
+      --proto_path=.. \
       --proto_path=. \
-      --proto_path=osv \
-      --proto_path=osv/osv-schema/proto \
-      --go_out=paths=source_relative:../../../bindings/go/api \
-      --go-grpc_out=paths=source_relative:../../../bindings/go/api \
+      --proto_path=../../osv \
+      --proto_path=../../osv/osv-schema/proto \
+      --go_out=paths=source_relative:../../bindings/go/api \
+      --go-grpc_out=paths=source_relative:../../bindings/go/api \
       osv_service_v1.proto
 
 build-protos: build-osv-protos build-api-protos ## Build all protocol buffers
 
+build-swagger: ## Build Swagger/OpenAPI documentation
+	./docs/build_swagger.sh
+
 build-website-frontend:
 	cd website/frontend3 && pnpm install && pnpm run build
 	cd website/blog && hugo --buildFuture -d ../dist/static/blog
@@ -127,26 +120,15 @@ run-go-website-prod: stage-website-assets
 # Run with `make run-api-server ARGS=--no-backend` to launch esp without backend.
 run-api-server: ## Run local Go API server with ESPv2 proxy
 	test -f $(HOME)/.config/gcloud/application_default_credentials.json || (echo "GCP Application Default Credentials not set, try 'gcloud auth application-default login'"; exit 1)
-	docker inspect osv/esp:latest >/dev/null 2>&1 || (cd gcp/api && docker build -f Dockerfile.esp -t osv/esp:latest .)
+	docker inspect osv/esp:latest >/dev/null 2>&1 || docker build -f docker/esp/Dockerfile -t osv/esp:latest docker/esp
 	@cd go && go build -o ./api-devserver ./cmd/api-devserver && (GOOGLE_CLOUD_PROJECT=oss-vdb OSV_VULNERABILITIES_BUCKET=osv-vulnerabilities ./api-devserver $(ARGS); EXIT_CODE=$$?; rm -f ./api-devserver; exit $$EXIT_CODE)
 
 # Run the Go developer server orchestrator against the staging/test environment.
 run-api-server-test:
 	test -f $(HOME)/.config/gcloud/application_default_credentials.json || (echo "GCP Application Default Credentials not set, try 'gcloud auth application-default login'"; exit 1)
-	docker inspect osv/esp:latest >/dev/null 2>&1 || (cd gcp/api && docker build -f Dockerfile.esp -t osv/esp:latest .)
+	docker inspect osv/esp:latest >/dev/null 2>&1 || docker build -f docker/esp/Dockerfile -t osv/esp:latest docker/esp
 	@cd go && go build -o ./api-devserver ./cmd/api-devserver && (GOOGLE_CLOUD_PROJECT=oss-vdb-test OSV_VULNERABILITIES_BUCKET=osv-test-vulnerabilities ./api-devserver $(ARGS); EXIT_CODE=$$?; rm -f ./api-devserver; exit $$EXIT_CODE)
 
-# Legacy Python API server targets
-run-python-api-server:
-	test -f $(HOME)/.config/gcloud/application_default_credentials.json || (echo "GCP Application Default Credentials not set, try 'gcloud auth application-default login'"; exit 1)
-	cd gcp/api && docker build -f Dockerfile.esp -t osv/esp:latest .
-	cd gcp/api && $(install-cmd) && GOOGLE_CLOUD_PROJECT=oss-vdb OSV_VULNERABILITIES_BUCKET=osv-vulnerabilities $(run-cmd) python test_server.py $(HOME)/.config/gcloud/application_default_credentials.json $(ARGS)
-
-run-python-api-server-test:
-	test -f $(HOME)/.config/gcloud/application_default_credentials.json || (echo "GCP Application Default Credentials not set, try 'gcloud auth application-default login'"; exit 1)
-	cd gcp/api && docker build -f Dockerfile.esp -t osv/esp:latest .
-	cd gcp/api && $(install-cmd) && GOOGLE_CLOUD_PROJECT=oss-vdb-test OSV_VULNERABILITIES_BUCKET=osv-test-vulnerabilities $(run-cmd) python test_server.py $(HOME)/.config/gcloud/application_default_credentials.json $(ARGS)
-
 # TODO: API integration tests.
 all-tests: lib-tests worker-tests importer-tests recoverer-tests website-tests vulnfeed-tests bindings-tests go-tests ## Run all tests
 

README.md

@@ -38,9 +38,8 @@ consists of:
 |-----------------|------|
 | `bindings/`     | Language bindings for the [OSV API](https://google.github.io/osv.dev/api/) (currently Go only) |
 | `deployment/`   | Terraform & Cloud Deploy config files <br /> A few Cloud Build config yamls |
-| `docker/`       | CI docker files (`ci`, `deployment`, `terraform`) <br /> `worker-base` docker image for `gcp/workers/worker` |
-| `docs/`         | Jekyll files for https://google.github.io/osv.dev/ <br /> `build_swagger.py` and `tools.go` |
-| `gcp/api`       | OSV API server files (including files for the local ESP server) <br /> protobuf files in `/v1`|
+| `docker/`       | CI docker files (`ci`, `deployment`, `terraform`, `esp`) <br /> `worker-base` docker image for `gcp/workers/worker` |
+| `docs/`         | Jekyll files for https://google.github.io/osv.dev/ <br /> `build_swagger.sh` and `tools.go` |
 | `gcp/datastore` | The datastore index file (`index.yaml`) |
 | `gcp/functions` | The Cloud Function for publishing PyPI vulnerabilities (maintained, but not developed) |
 | `gcp/indexer`   | The determine version `indexer` |

cloudbuild.yaml

@@ -32,11 +32,6 @@ steps:
   args: ['gcloud', 'builds', 'submit', '--region=${LOCATION}', '--config=gcp/website/cloudbuild.yaml', '.']
   waitFor: ['init']
 
-- name: 'gcr.io/google.com/cloudsdktool/cloud-sdk:slim'
-  id: 'api-tests'
-  args: ['gcloud', 'builds', 'submit', '--region=${LOCATION}', '--config=gcp/api/cloudbuild.yaml', '.']
-  waitFor: ['init']
-
 - name: 'gcr.io/google.com/cloudsdktool/cloud-sdk:slim'
   id: 'vulnfeeds-tests'
   args: ['gcloud', 'builds', 'submit', '--region=${LOCATION}', '--config=vulnfeeds/cloudbuild.yaml', '.']

deployment/terraform/environments/oss-vdb-test/api/api_descriptor.pb

@@ -1 +1 @@
-../../../../../gcp/api/v1/api_descriptor.pb
+../../../../../proto/v1/api_descriptor.pb

deployment/terraform/environments/oss-vdb/api/api_descriptor.pb

@@ -1 +1 @@
-../../../../../gcp/api/v1/api_descriptor.pb
+../../../../../proto/v1/api_descriptor.pb

docs/README.md

@@ -60,5 +60,5 @@ go mod download
 ### Generation
 
 ```bash
-python3 ./build_swagger.py
+./build_swagger.sh
 ```

docs/build_swagger.sh

@@ -0,0 +1,36 @@
+#!/usr/bin/env bash
+# Copyright 2026 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+set -euo pipefail
+
+DOCS_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+ROOT_DIR="$(dirname "$DOCS_DIR")"
+TARGET_FILE="$DOCS_DIR/osv_service_v1.swagger.json"
+GENERATED_FILE="$DOCS_DIR/v1/osv_service_v1.swagger.json"
+
+protoc \
+  -I "$ROOT_DIR/proto" \
+  -I "$ROOT_DIR/proto/v1" \
+  -I "$ROOT_DIR/osv" \
+  -I "$ROOT_DIR/osv/osv-schema/proto" \
+  --openapiv2_out="$DOCS_DIR" \
+  --openapiv2_opt=logtostderr=true \
+  "$ROOT_DIR/proto/v1/osv_service_v1.proto"
+
+# Set OpenAPI host and metadata
+jq '.host = "api.osv.dev" | .info.title = "OSV" | .info.version = "1.0"' "$GENERATED_FILE" > "$TARGET_FILE"
+
+rm -f "$GENERATED_FILE"
+rmdir "$DOCS_DIR/v1" 2>/dev/null || true

docs/contributing/architecture.md

@@ -43,7 +43,7 @@ workloads.
 
 The [API server] runs on [Cloud Run], and is served by [Cloud Endpoints].
 
-[API server]: https://github.com/google/osv.dev/tree/master/gcp/api
+[API server]: https://github.com/google/osv.dev/tree/master/go/cmd/api
 [Cloud Run]: https://cloud.google.com/run
 [Cloud Endpoints]: https://cloud.google.com/endpoints