refactor(ci): reuse protobuf compatibility action

Signed-off-by: Simon Scatton <sscatton@nvidia.com>

Author: SDAChess

.agents/skills/watch-github-actions/SKILL.md

@@ -132,10 +132,11 @@ not substitute the current `main` tip or the event's older PR base SHA. Merge
 groups and manual runs use their explicit baseline. Findings are reported by
 `Reject new high or critical findings`; distinguish those from scanner failures.
 
-For `Protobuf API compatibility`, check the logged train and comparison baseline.
+For `Protobuf Compatibility`, check the logged train and comparison baseline.
 Branch Checks compares the prospective merge tree with its target; Release Tag
 compares the tagged candidate with the previous stable release. Both use
-`nix develop .#proto`. During `0.x`, a minor train permits compatibility findings
+the shared `check-protobuf-compatibility` action with `nix develop .#proto`.
+During `0.x`, a minor train permits compatibility findings
 as warnings; a patch train or no active train rejects them. Compare the current
 train's version with the latest stable release; commit messages are irrelevant.
 Compilation, baseline, and tool errors remain fatal. The `protobuf_compatibility` suite participates in

.github/actions/check-protobuf-compatibility/action.yml

@@ -0,0 +1,35 @@
+# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-License-Identifier: Apache-2.0
+
+name: Check Protobuf Compatibility
+description: Check protobuf compatibility against the target or latest stable release using the release train policy. Requires a checkout with full history and tags.
+
+inputs:
+  target-ref:
+    description: PR or merge-group target commit/ref. Supply either target-ref or release-tag.
+    required: false
+    default: ""
+  release-tag:
+    description: Prerelease or stable tag to qualify. Supply either target-ref or release-tag.
+    required: false
+    default: ""
+
+runs:
+  using: composite
+  steps:
+    - uses: ./.github/actions/setup-nix
+
+    - name: Check protobuf compatibility
+      shell: nix develop .#proto --no-write-lock-file -c bash -euo pipefail {0}
+      env:
+        TARGET_REF: ${{ inputs.target-ref }}
+        RELEASE_TAG: ${{ inputs.release-tag }}
+      run: |
+        args=()
+        if [[ -n "$TARGET_REF" ]]; then
+          args+=(--target "$TARGET_REF")
+        fi
+        if [[ -n "$RELEASE_TAG" ]]; then
+          args+=(--release "$RELEASE_TAG")
+        fi
+        uv run --no-project --python python3 tasks/scripts/check_proto_compatibility.py "${args[@]}"

.github/workflows/branch-checks.yml

@@ -37,32 +37,25 @@ jobs:
       - id: gate
         uses: ./.github/actions/pr-gate
 
-  proto-breaking:
-    name: Protobuf API compatibility
+  protobuf-compatibility:
+    name: Protobuf Compatibility
     needs: pr_metadata
     if: needs.pr_metadata.outputs.should_run == 'true'
     runs-on: linux-amd64-cpu8
     timeout-minutes: 15
-    defaults:
-      run:
-        shell: nix develop .#proto --no-write-lock-file -c bash -euo pipefail {0}
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
           persist-credentials: false
 
-      - uses: ./.github/actions/setup-nix
-
-      - name: Check protobuf API compatibility
-        env:
-          TARGET_REF: ${{ github.event.merge_group.base_sha || needs.pr_metadata.outputs.base_sha }}
-          DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
-        run: |
-          if [[ "$GITHUB_EVENT_NAME" == workflow_dispatch ]]; then
-            TARGET_REF="refs/remotes/origin/$DEFAULT_BRANCH"
-          fi
-          uv run --no-project --python python3 tasks/scripts/check_proto_compatibility.py --target "$TARGET_REF"
+      - uses: ./.github/actions/check-protobuf-compatibility
+        with:
+          target-ref: >-
+            ${{ github.event_name == 'workflow_dispatch'
+                && format('refs/remotes/origin/{0}', github.event.repository.default_branch)
+                || github.event.merge_group.base_sha
+                || needs.pr_metadata.outputs.base_sha }}
 
   mise-lockfile:
     name: mise Lockfile

.github/workflows/release-tag.yml

@@ -214,8 +214,8 @@ jobs:
       checkout-ref: ${{ needs.compute-versions.outputs.source_sha }}
       conformance-artifact-prefix: openshell-conformance
 
-  proto-breaking:
-    name: Protobuf API compatibility
+  protobuf-compatibility:
+    name: Protobuf Compatibility
     needs: compute-versions
     runs-on: linux-amd64-cpu8
     timeout-minutes: 15
@@ -226,18 +226,16 @@ jobs:
           persist-credentials: false
           ref: ${{ needs.compute-versions.outputs.source_sha }}
 
-      - uses: ./.github/actions/setup-nix
-
-      - name: Check release protobuf API compatibility
-        shell: nix develop .#proto --no-write-lock-file -c bash -euo pipefail {0}
-        run: uv run --no-project --python python3 tasks/scripts/check_proto_compatibility.py --release "$RELEASE_TAG"
+      - uses: ./.github/actions/check-protobuf-compatibility
+        with:
+          release-tag: ${{ env.RELEASE_TAG }}
 
   qualification-result:
     name: Release Qualification
     if: always()
     needs:
       - compute-versions
-      - proto-breaking
+      - protobuf-compatibility
       - security
       - conformance-integration
       - feature-specific-integration
@@ -263,7 +261,7 @@ jobs:
           DOCKER_E2E_RESULT: ${{ needs.docker-e2e.result }}
           FEATURE_INTEGRATION_RESULT: ${{ needs.feature-specific-integration.result }}
           IS_PRERELEASE: ${{ needs.compute-versions.outputs.is_prerelease }}
-          PROTO_COMPATIBILITY_RESULT: ${{ needs.proto-breaking.result }}
+          PROTO_COMPATIBILITY_RESULT: ${{ needs.protobuf-compatibility.result }}
           SECURITY_RESULT: ${{ needs.security.result }}
           SOURCE_SHA: ${{ needs.compute-versions.outputs.source_sha }}
           VM_E2E_RESULT: ${{ needs.vm-e2e.result }}

CI.md

@@ -19,8 +19,9 @@ Merge queue validation is a second integration gate for `main`. After a PR has p
 
 ### Protobuf API compatibility
 
-`Protobuf API compatibility` runs in Branch Checks and Release Tag through the
-lockfile-pinned `proto` Nix shell. It uses Buf's `FILE` policy for the `proto/`
+`Protobuf Compatibility` runs in Branch Checks and Release Tag through the shared
+`check-protobuf-compatibility` action and lockfile-pinned `proto` Nix shell.
+It uses Buf's `FILE` policy for the `proto/`
 module, covering SDK descriptors and extension contracts. Storage-only protobufs
 remain subject to their separate durability checks.