Modernize proto Buf CI

[haasonsaas]

Summary

• migrate from bufbuild/buf-setup-action to the supported bufbuild/buf-action bridge with setup_only: true
• remove duplicate buf generate runs from packaging jobs and keep generation drift enforcement in the dedicated generate gate
• add the missing traces TypeScript package export and include traces in the Python package smoke check

Verification

• buf generate --timeout 10m && git diff --exit-code -- gen
• go test ./... -count=1
• actionlint .github/workflows/ci.yml
• npm ci && npm run check:package
• python3 -m venv .venv-build && . .venv-build/bin/activate && python -m pip install --upgrade build && python -m build

[cursor]

PR Summary

Low Risk
CI-only changes that adjust Buf action usage and job responsibilities; main risk is misconfigured secrets/action inputs causing lint/breaking/generate jobs to fail.

Overview
Modernizes Buf usage in CI by replacing bufbuild/buf-setup-action with bufbuild/buf-action@v1 (setup-only) and wiring in a BUF_TOKEN.

Simplifies packaging jobs by removing duplicate buf generate and drift checks from the TypeScript and Python package jobs, leaving generation enforcement in the dedicated generate gate.

Fixes missing proto surface exports/tests by adding the ./traces/v1/traces_pb export to package.json and extending the Python wheel smoke import/assert to include traces.v1.TraceSummary.

^{Reviewed by Cursor Bugbot for commit c55b3b5. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{Bugbot Autofix is ON, but it could not run because the branch was deleted or merged before autofix could start.}

^{Reviewed by Cursor Bugbot for commit c55b3b5. Configure here.}

[cursor]

Unpinned action reference will fail security guardrails

High Severity

bufbuild/buf-action@v1 uses a mutable tag instead of a full SHA pin. Every other action in this file is pinned to a 40-character commit hash. The project's own workflow-security-guardrails job runs check-workflow-security-baseline.sh with ENFORCE_SHA_PINS: 'true', which will reject any uses: reference that isn't a full-length SHA — so this PR will fail that CI gate.

Additional Locations (2)

• .github/workflows/ci.yml#L33-L34
• .github/workflows/ci.yml#L45-L46

 

^{Reviewed by Cursor Bugbot for commit c55b3b5. Configure here.}