ci: install Protoc for Linux, macOS, and Windows

[moabu]

Added installation steps for Protoc based on the OS.

Prepare

• Read PR guidelines
• Read license information

---

Description

Target issue

closes #13550

Implementation Details

---

Test and Document the changes

• Static code analysis has been run locally and issues have been fixed
• Relevant unit and integration tests have been added/updated
• Relevant documentation has been updated if any (i.e. user guides, installation and configuration guides, technical design docs etc)

Please check the below before submitting your PR. The PR will not be merged if there are no commits that start with docs: to indicate documentation changes or if the below checklist is not selected.

• I confirm that there is no impact on the docs due to the code changes in this PR.

Summary by CodeRabbit

• Chores
  • Ensure the Protobuf compiler is installed in CI for build, packaging, and signing workflows so protoc is available before packaging steps.
  • Add OS-specific Protobuf installation and PATH handling for Linux, macOS, and Windows, and apply conditional installation logic across build variants (Python, WASM, Go, and packaging) so builds can reliably locate protoc.

[mo-auto]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[coderabbitai]

📝 Walkthrough

Walkthrough

Added Protobuf compiler installation to .github/workflows/build-packages.yml across CI jobs: publish_binary_packages, build_cedarling_python, build_cedarling_wasm, build_cedarling_uniffi, and build_cedarling_go. The Go job uses OS-conditional installation and exposes PROTOC/updates PATH on Windows.

Changes

Cohort / File(s)	Summary
Protoc installation in CI workflow .github/workflows/build-packages.yml	Added Protobuf compiler installation steps in multiple jobs. publish_binary_packages, build_cedarling_python, build_cedarling_wasm, and build_cedarling_uniffi install protobuf-compiler via apt-get. build_cedarling_go adds an OS-conditional Install Protoc (Native) step: apt-get on Linux, brew on macOS, and winget plus locating protoc.exe, exporting PROTOC, and updating PATH on Windows.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~8 minutes

Suggested labels

comp-jans-cedarling

Suggested reviewers

• 0xtinkle

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The PR title accurately describes the main change: adding Protoc installation for multiple operating systems in the CI workflow.
Description check	✅ Passed	The description includes the required target issue (#13550) and acknowledges the prepare checklist, though testing/documentation checkboxes remain unchecked.
Linked Issues check	✅ Passed	The PR successfully addresses the linked issue #13550 by installing Protoc on Linux, macOS, and Windows in the CI workflow, directly resolving the failing cedarling builds.
Out of Scope Changes check	✅ Passed	All changes are directly scoped to adding Protoc installation steps across multiple CI jobs, aligning with the objective to fix failing cedarling builds.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch ci-fix-cedarling-build

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Inline comments:
In @.github/workflows/build-packages.yml:
- Around line 757-758: The workflow step named "Install Protoc" contains
trailing whitespace at the end of the run line; remove the trailing spaces after
"protobuf-compiler" in the run command so the line reads without any trailing
whitespace (update the run value in the Install Protoc step).
- Around line 577-587: In the "Install Protoc (Native)" GitHub Actions step the
hardcoded Windows path echo (the line echo "C:\Program Files\Protobuf\bin" >>
$GITHUB_PATH) is incorrect and redundant; remove that echo line from the step so
winget can manage PATH automatically, or alternatively replace the whole step
with a cross-platform setup action (e.g., arduino/setup-protoc) to ensure
reliable protoc installation across OSes.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: 8b2009e8-1e39-4a19-9fe1-c19223de470b

📥 Commits

Reviewing files that changed from the base of the PR and between e14944d and 28764f8.

📒 Files selected for processing (1)

• .github/workflows/build-packages.yml

[coderabbitai]

♻️ Duplicate comments (1)

.github/workflows/build-packages.yml (1)

584-586: ⚠️ Potential issue | 🟠 Major

Remove the guessed Windows protoc path.

Line 586 hardcodes C:\Program Files\Protobuf\bin, but Google.Protobuf is published to winget as a ZIP/portable install whose nested binary is bin/protoc.exe and whose binaries depend on PATH. WinGet’s portable roots are under its ...WinGet\Links / ...WinGet\Packages directories, and PATH propagation for portable installs has had edge cases, so this guessed directory can still leave protoc unresolved in the next step. Please resolve the actual WinGet links directory or the installed protoc.exe parent before appending to $GITHUB_PATH. (raw.githubusercontent.com)

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In @.github/workflows/build-packages.yml around lines 584 - 586, The hardcoded
path "C:\Program Files\Protobuf\bin" is unreliable after running winget install
Google.Protobuf; instead, locate the actual installed protoc.exe and append its
parent directory to $GITHUB_PATH: after the winget step, search the WinGet
links/packages locations (or run a discovery like searching for protoc.exe in
$env:ProgramData\Microsoft\Windows\Start Menu\Programs, the WinGet Links folder,
or via where/proc-finding command) and then echo the discovered parent directory
into $GITHUB_PATH (use the discovered path variable rather than the guessed
literal). Ensure you reference the installed Google.Protobuf package and
protoc.exe when implementing the discovery so PATH propagation is robust across
portable WinGet installs.

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Duplicate comments:
In @.github/workflows/build-packages.yml:
- Around line 584-586: The hardcoded path "C:\Program Files\Protobuf\bin" is
unreliable after running winget install Google.Protobuf; instead, locate the
actual installed protoc.exe and append its parent directory to $GITHUB_PATH:
after the winget step, search the WinGet links/packages locations (or run a
discovery like searching for protoc.exe in
$env:ProgramData\Microsoft\Windows\Start Menu\Programs, the WinGet Links folder,
or via where/proc-finding command) and then echo the discovered parent directory
into $GITHUB_PATH (use the discovered path variable rather than the guessed
literal). Ensure you reference the installed Google.Protobuf package and
protoc.exe when implementing the discovery so PATH propagation is robust across
portable WinGet installs.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: e837ec03-3995-4db7-bdf5-e597795f07bd

📥 Commits

Reviewing files that changed from the base of the PR and between 4240a48 and 5bcf62e.

📒 Files selected for processing (1)

• .github/workflows/build-packages.yml

[coderabbitai]

♻️ Duplicate comments (1)

.github/workflows/build-packages.yml (1)

586-590: ⚠️ Potential issue | 🟠 Major

Remove the invalid Windows fallback path.

Line 588 falls back to /c/Program Files/Protobuf/bin/protoc.exe, but the documented default WinGet portable roots are %LOCALAPPDATA%/Microsoft/WinGet/Packages/ and %PROGRAMFILES%/WinGet/Packages/. If the search on Line 586 misses, this branch exports a path WinGet does not document and the job fails later in cargo build instead of here. Prefer failing immediately over keeping this fallback. (learn.microsoft.com)

🛠️ Proposed fix

           elif [ "$RUNNER_OS" == "Windows" ]; then
             winget install --id=Google.Protobuf -e --accept-package-agreements --accept-source-agreements
             PROTOC_PATH=$(find /c/Users/runneradmin/AppData/Local/Microsoft/WinGet/Packages -name protoc.exe | head -n 1)
-            if [ -z "$PROTOC_PATH" ]; then
-              PROTOC_PATH="/c/Program Files/Protobuf/bin/protoc.exe"
-            fi
+            if [ -z "$PROTOC_PATH" ] || [ ! -f "$PROTOC_PATH" ]; then
+              echo "protoc.exe not found after winget install" >&2
+              exit 1
+            fi
             echo "PROTOC=$PROTOC_PATH" >> $GITHUB_ENV
             echo "$(dirname "$PROTOC_PATH")" >> $GITHUB_PATH

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In @.github/workflows/build-packages.yml around lines 586 - 590, The fallback
assignment that sets PROTOC_PATH to "/c/Program Files/Protobuf/bin/protoc.exe"
is invalid and should be removed; instead, after running the find that sets
PROTOC_PATH, detect if PROTOC_PATH is empty and fail early (print a clear error
to stderr and exit non‑zero) rather than exporting a bogus path to $GITHUB_ENV.
Update the logic around the PROTOC_PATH variable and the echo
"PROTOC=$PROTOC_PATH" >> $GITHUB_ENV so the job aborts immediately with an
explanatory error if the find command yields no result (reference: the
PROTOC_PATH variable, the find invocation and the $GITHUB_ENV export).

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Duplicate comments:
In @.github/workflows/build-packages.yml:
- Around line 586-590: The fallback assignment that sets PROTOC_PATH to
"/c/Program Files/Protobuf/bin/protoc.exe" is invalid and should be removed;
instead, after running the find that sets PROTOC_PATH, detect if PROTOC_PATH is
empty and fail early (print a clear error to stderr and exit non‑zero) rather
than exporting a bogus path to $GITHUB_ENV. Update the logic around the
PROTOC_PATH variable and the echo "PROTOC=$PROTOC_PATH" >> $GITHUB_ENV so the
job aborts immediately with an explanatory error if the find command yields no
result (reference: the PROTOC_PATH variable, the find invocation and the
$GITHUB_ENV export).

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: fae282f6-560f-4bc9-b675-0471eaafc02d

📥 Commits

Reviewing files that changed from the base of the PR and between 5bcf62e and 74af282.

📒 Files selected for processing (1)

• .github/workflows/build-packages.yml