Skip to content

ci: automate protobuf source generation for Renovate updates #1920

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
zeitlinger merged 4 commits into from
Mar 5, 2026
+75 −5
Merged

ci: automate protobuf source generation for Renovate updates #1920

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
c502a66
ci: automate protobuf source generation for Renovate updates
zeitlinger Feb 27, 2026
68a0d20
ci: clarify GITHUB_TOKEN limitation and close/reopen workaround
zeitlinger Feb 27, 2026
87f97d4
ci: fix lint issues in generate-protobuf workflow
zeitlinger Feb 27, 2026
b1b5559
ci: remove mise.toml from generate workflow commit scope
zeitlinger Feb 27, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 3 additions & 0 deletions .github/renovate-tracked-deps.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,6 +8,9 @@
".github/workflows/build.yml": {
"regex": ["mise"]
},
".github/workflows/generate-protobuf.yml": {
"regex": ["mise"]
},
".github/workflows/github-pages.yaml": {
"regex": ["mise"]
},
Expand Down
6 changes: 6 additions & 0 deletions .github/renovate.json5
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -32,6 +32,12 @@
description: "Ignore internal project modules",
matchPackageNames: ["/^io\\.prometheus:(examples|example-.+|integration-tests|it-.+)$/"],
},
{
description: "Group protobuf-java and protoc together so generated code can be updated in one PR",
matchDepNames: ["com.google.protobuf:protobuf-java", "protoc"],
groupName: "protobuf",
separateMajorMinor: false,
},
],
customManagers: [],
}
64 changes: 64 additions & 0 deletions .github/workflows/generate-protobuf.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,64 @@
---
name: Generate Protobuf

on:
push:
branches:
- "renovate/protobuf"
Comment on lines +4 to +7
Copy link

@martincostello martincostello Mar 2, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Note that a push for this from renovate could still theoretically contain untrusted code if the dependency being updated was compromised and a malicious version published.

If the update contained malicious code that tried to steal GITHUB_TOKEN (or whatever secret is used), it would able to perform arbitrary write operations on the repository, or whatever permissions that token had.

It's risky performing automated writes to the repository with elevated permissions in this context.

It's not something I've tried to do myself, but a safer approach could be to have this job only generate a Git patch for the changes as a build artifact, and then have another job/workflow take that artifact and apply it after applying some sanity checks (e.g. the diff only updates the expected files). Then any compromised code isn't able to actually execute with access to the secrets but the protobuf files can still be regenerated.

Copy link
Member Author

@zeitlinger zeitlinger Mar 5, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The attack vector here is a compromised protoc binary or protobuf-java library. The mitigations are:

  1. Only .java files can be committed — anything else fails the workflow
  2. protoc is downloaded from Google's official GitHub releases via mise
  3. The workflow only has contents: write — no admin, no secrets beyond GITHUB_TOKEN
  4. The generated code still goes through normal CI and review before merge

This is the same trust model as running protoc locally — we're trusting Google's releases. If protoc itself were compromised, we'd have bigger problems regardless of automation.


permissions: {}

jobs:
generate:
runs-on: ubuntu-24.04
permissions:
contents: write
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
with:
ref: ${{ github.ref }}
# zizmor: ignore[artipacked] -- needs credentials to push
persist-credentials: true
- uses: jdx/mise-action@6d1e696aa24c1aa1bcc1adea0212707c71ab78a8 # v3.6.1
with:
version: v2026.2.11
sha256: 3e1baedb9284124b770d2d561a04a98c343d05967c83deb8b35c7c941f8d9c9a
- name: Cache local Maven repository
uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
with:
path: ~/.m2/repository
key: ${{ runner.os }}-maven-${{ hashFiles('**/pom.xml') }}
restore-keys: |
${{ runner.os }}-maven-
- name: Verify both protobuf deps are updated
run: |
git fetch origin main
DIFF_POM=$(git diff origin/main -- pom.xml)
DIFF_MISE=$(git diff origin/main -- mise.toml)
if ! echo "$DIFF_POM" | grep -q 'protobuf-java.version'; then
echo "::error::protobuf-java not updated in pom.xml"
exit 1
fi
if ! echo "$DIFF_MISE" | grep -q 'protoc'; then
echo "::error::protoc not updated in mise.toml"
exit 1
fi
- name: Generate protobuf sources
run: mise run generate
- name: Commit and push generated sources
run: |
git diff --quiet && exit 0
UNEXPECTED=$(git diff --name-only | grep -v '\.java$' || true)
if [[ -n "$UNEXPECTED" ]]; then
echo "::error::Unexpected files changed:"
echo "$UNEXPECTED"
exit 1
fi
# Note: GITHUB_TOKEN pushes don't trigger CI re-runs.
# Close and reopen the PR to trigger CI after this commit.
# TODO: switch to PROMBOT_GITHUB_TOKEN once it's added to this repo.
Copy link

@martincostello martincostello Mar 2, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

If PROMBOT_GITHUB_TOKEN has permissions greater than contents: write (e.g. if it had admin access) then that might be even riskier than using GITHUB_TOKEN regardless of whether it can trigger CI or not.

Copy link
Member Author

@zeitlinger zeitlinger Mar 5, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Good point — PROMBOT_GITHUB_TOKEN should be scoped to contents: write only, same as GITHUB_TOKEN. I'll note that in the TODO. For now the workflow uses GITHUB_TOKEN which can't have elevated permissions.

git config user.name "github-actions[bot]"
git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
git add '*.java'
git commit -m "chore: regenerate protobuf sources"
git push
7 changes: 2 additions & 5 deletions mise.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -31,11 +31,8 @@ description = "bare compile, ignoring formatting and linters"
run = "./mvnw install -DskipTests -Dspotless.check.skip=true -Dcoverage.skip=true -Dcheckstyle.skip=true -Dwarnings=-nowarn"

[tasks.generate]
description = "bare compile, ignoring formatting and linters"
run = [
"mise use --pin protoc@latest",
"./mvnw clean install -DskipTests -Dspotless.check.skip=true -Dcoverage.skip=true -Dcheckstyle.skip=true -Dwarnings=-nowarn"
]
description = "regenerate protobuf sources"
run = "./mvnw clean install -DskipTests -Dspotless.check.skip=true -Dcoverage.skip=true -Dcheckstyle.skip=true -Dwarnings=-nowarn"
env.PROTO_GENERATION = "true"

[tasks.test]
Expand Down