From e45e59ad3928fac5e5e369e3f49f909e6d738ad7 Mon Sep 17 00:00:00 2001
From: Ian McEwen <ian@ianmcorvidae.net>
Date: Tue, 11 Aug 2026 11:32:44 -0700
Subject: [PATCH 1/2] Improve update_protobufs workflow to use release
 versions, put version in commit, and allow specifying a version, as well as
 allowing dispatch from other repositories.

---
 .github/workflows/update_protobufs.yml | 42 +++++++++++++++++++++++---
 1 file changed, 38 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/update_protobufs.yml b/.github/workflows/update_protobufs.yml
index b9c75583c..dda3d54e7 100644
--- a/.github/workflows/update_protobufs.yml
+++ b/.github/workflows/update_protobufs.yml
@@ -1,5 +1,15 @@
 name: "Update protobufs"
-on: workflow_dispatch
+
+on:
+  workflow_dispatch:
+    inputs:
+      version:
+        description: "Protobufs version tag to sync to (e.g., v2.7.26). Defaults to the latest protobufs release."
+        required: false
+        default: ""
+        type: string
+  repository_dispatch:
+    types: [protobufs-release]
 
 permissions:
   contents: write
@@ -25,11 +35,35 @@ jobs:
           python -m pip install --upgrade pip
           python -m pip install poetry
 
-      - name: Update protobuf submodule
+      - name: Determine target protobufs version
+        id: version
+        run: |
+          cd protobufs
+          git fetch --tags
+
+          if [ -n "${{ github.event.inputs.version }}" ]; then
+            target="${{ github.event.inputs.version }}"
+          elif [ -n "${{ github.event.client_payload.version }}" ]; then
+            target="${{ github.event.client_payload.version }}"
+          else
+            target=$(git describe --tags --abbrev=0)
+          fi
+
+          if ! git rev-parse --verify "refs/tags/${target}" >/dev/null 2>&1; then
+            echo "Error: '${target}' is not a valid tag in meshtastic/protobufs"
+            exit 1
+          fi
+
+          echo "version=${target}" >> "$GITHUB_OUTPUT"
+          echo "Target protobufs version: ${target}"
+
+      - name: Update protobuf submodule to release
         run: |
           git submodule sync --recursive
           git submodule update --init --recursive
-          git submodule update --remote --recursive
+          cd protobufs
+          git checkout ${{ steps.version.outputs.version }}
+          cd ..
 
       - name: Download nanopb
         run: |
@@ -53,7 +87,7 @@ jobs:
           git add protobufs
           git add meshtastic/protobuf
           if [[ -n "$(git status --porcelain)" ]]; then
-            git commit -m "Update protobufs"
+            git commit -m "protobufs: ${{ steps.version.outputs.version }}"
             git push
           else
             echo "No changes to commit"

From 33840e2cee544ff13766fbe1fbe53578fdb34b32 Mon Sep 17 00:00:00 2001
From: Ian McEwen <ian@ianmcorvidae.net>
Date: Tue, 11 Aug 2026 11:47:18 -0700
Subject: [PATCH 2/2] Fix review comments/zizmor lint

---
 .github/workflows/update_protobufs.yml | 30 ++++++++++++++++++--------
 1 file changed, 21 insertions(+), 9 deletions(-)

diff --git a/.github/workflows/update_protobufs.yml b/.github/workflows/update_protobufs.yml
index dda3d54e7..b3f1feeee 100644
--- a/.github/workflows/update_protobufs.yml
+++ b/.github/workflows/update_protobufs.yml
@@ -24,6 +24,7 @@ jobs:
         with:
           fetch-depth: 0
           submodules: true
+          persist-credentials: false
 
       - name: Setup Python
         uses: actions/setup-python@v5
@@ -37,32 +38,41 @@ jobs:
 
       - name: Determine target protobufs version
         id: version
+        env:
+          INPUT_VERSION: ${{ github.event.inputs.version }}
+          PAYLOAD_VERSION: ${{ github.event.client_payload.version }}
         run: |
           cd protobufs
           git fetch --tags
 
-          if [ -n "${{ github.event.inputs.version }}" ]; then
-            target="${{ github.event.inputs.version }}"
-          elif [ -n "${{ github.event.client_payload.version }}" ]; then
-            target="${{ github.event.client_payload.version }}"
+          if [ -n "${INPUT_VERSION}" ]; then
+            target="${INPUT_VERSION}"
+          elif [ -n "${PAYLOAD_VERSION}" ]; then
+            target="${PAYLOAD_VERSION}"
           else
-            target=$(git describe --tags --abbrev=0)
+            target=$(git tag --list 'v*' --sort=-version:refname | head -n1)
+            if [ -z "${target}" ]; then
+              echo "Error: no release tags found in meshtastic/protobufs"
+              exit 1
+            fi
           fi
 
-          if ! git rev-parse --verify "refs/tags/${target}" >/dev/null 2>&1; then
+          if ! git show-ref --verify --quiet "refs/tags/${target}"; then
             echo "Error: '${target}' is not a valid tag in meshtastic/protobufs"
             exit 1
           fi
 
-          echo "version=${target}" >> "$GITHUB_OUTPUT"
+          printf 'version=%s\n' "${target}" >> "$GITHUB_OUTPUT"
           echo "Target protobufs version: ${target}"
 
       - name: Update protobuf submodule to release
+        env:
+          TARGET_VERSION: ${{ steps.version.outputs.version }}
         run: |
           git submodule sync --recursive
           git submodule update --init --recursive
           cd protobufs
-          git checkout ${{ steps.version.outputs.version }}
+          git checkout "${TARGET_VERSION}"
           cd ..
 
       - name: Download nanopb
@@ -80,6 +90,8 @@ jobs:
           ./bin/regen-protobufs.sh
 
       - name: Commit update
+        env:
+          TARGET_VERSION: ${{ steps.version.outputs.version }}
         run: |
           git config --global user.name 'github-actions'
           git config --global user.email 'bot@noreply.github.com'
@@ -87,7 +99,7 @@ jobs:
           git add protobufs
           git add meshtastic/protobuf
           if [[ -n "$(git status --porcelain)" ]]; then
-            git commit -m "protobufs: ${{ steps.version.outputs.version }}"
+            git commit -m "protobufs: ${TARGET_VERSION}"
             git push
           else
             echo "No changes to commit"