From 80c83a9da2a4e589522c3e3649f299f715a0d9c8 Mon Sep 17 00:00:00 2001
From: "Philip K. Warren" <pkwarren@users.noreply.github.com>
Date: Thu, 23 Apr 2026 08:49:00 -0500
Subject: [PATCH] Move BSR login into the buf-action step

PRs opened from forks currently fail as the BUF_TOKEN secret isn't
available. Update the workflows to move BSR login into the buf-action
step, which gracefully handles an empty token and skips authentication.
---
 .github/workflows/ci.yaml          | 4 +---
 .github/workflows/conformance.yaml | 4 +---
 .github/workflows/release.yaml     | 9 +--------
 3 files changed, 3 insertions(+), 14 deletions(-)

diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index 772a2e42..30b27381 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -34,9 +34,7 @@ jobs:
       - uses: bufbuild/buf-action@fd21066df7214747548607aaa45548ba2b9bc1ff # v1.4.0
         with:
           setup_only: true
-      - env:
-          BUF_TOKEN: ${{ secrets.BUF_TOKEN }}
-        run: echo ${BUF_TOKEN} | buf registry login buf.build --token-stdin
+          token: ${{ secrets.BUF_TOKEN }}
       - name: Validate Gradle Wrapper
         uses: gradle/actions/wrapper-validation@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0
       - name: Lint
diff --git a/.github/workflows/conformance.yaml b/.github/workflows/conformance.yaml
index e7b023fa..3e5fd58d 100644
--- a/.github/workflows/conformance.yaml
+++ b/.github/workflows/conformance.yaml
@@ -34,9 +34,7 @@ jobs:
       - uses: bufbuild/buf-action@fd21066df7214747548607aaa45548ba2b9bc1ff # v1.4.0
         with:
           setup_only: true
-      - env:
-          BUF_TOKEN: ${{ secrets.BUF_TOKEN }}
-        run: echo ${BUF_TOKEN} | buf registry login buf.build --token-stdin
+          token: ${{ secrets.BUF_TOKEN }}
       - name: Validate Gradle Wrapper
         uses: gradle/actions/wrapper-validation@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0
       - name: Test conformance
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index 65d667d0..5c2b0ec2 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -14,7 +14,6 @@ jobs:
 
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-
       - name: Cache Go Modules
         uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
         with:
@@ -24,23 +23,17 @@ jobs:
           key: ${{ runner.os }}-gomod-ci-${{ hashFiles('gradle.properties', 'gradle/libs.versions.toml') }}
           restore-keys:
             ${{ runner.os }}-gomod-ci-
-
       - name: Set up JDK
         uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
         with:
           distribution: 'temurin'
           java-version: '21'
-
       - uses: bufbuild/buf-action@fd21066df7214747548607aaa45548ba2b9bc1ff # v1.4.0
         with:
           setup_only: true
-      - env:
-          BUF_TOKEN: ${{ secrets.BUF_TOKEN }}
-        run: echo ${BUF_TOKEN} | buf registry login buf.build --token-stdin
-
+          token: ${{ secrets.BUF_TOKEN }}
       - name: Validate Gradle Wrapper
         uses: gradle/actions/wrapper-validation@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0
-
       - name: Configure GPG signing & publish
         env:
           GPG_KEY: ${{ secrets.GPG_KEY }}