[intel352]

Summary

• authenticate arduino/setup-protoc release discovery with the built-in GitHub job token on github.com
• pin setup-protoc v3.0.0 to its verified commit before exposing the credential
• preserve anonymous setup behavior on GitHub Enterprise Server

Why

Main Lint run 29270292677 failed in Set up CI environment because unauthenticated setup-protoc release discovery hit GitHub's shared-IP API limit. The failed-job rerun passed, confirming an external rate-limit flake. setup-protoc v3 documents repo-token specifically for this boundary.

No custom secret is added. ${{ github.token }} is the GitHub-provided job token expression, not a credential value.

Verification

• fresh CI run 37080771689: changes, backend, core, sdk, bridge, demo, and ci-pass passed
• fresh Lint run 37080771767: format, clippy, and spell-check passed
• actionlint -ignore 'actions-rs/toolchain@v1' .github/workflows/*.yml
• git diff --check
• verified c65c819552d16ad3c9b72d9dfd5ba5237b9c906b is the peeled v3.0.0 tag commit
• spec review: PASS at exact base c98bc1f770fae112f86c47d6da2ca11684409eca and head 884110ea619fadc584aefb04c777109739707b4e

Runtime launch transcript

Build/launch boundary: the fresh PR CI run executed the changed composite action on GitHub-hosted Linux and then ran the repository's core test workload.

$ gh run view 37080771689 --repo GoCodeAlone/encrypted-spaces --job 111080628996 --log
Download action repository 'arduino/setup-protoc@c65c819552d16ad3c9b72d9dfd5ba5237b9c906b'
Run arduino/setup-protoc@c65c819552d16ad3c9b72d9dfd5ba5237b9c906b
Getting protoc version: v23.4
Downloading archive: https://github.com/protocolbuffers/protobuf/releases/download/v23.4/protoc-23.4-linux-x86_64.zip
Protoc cached under /opt/hostedtoolcache/protoc/v23.4/x64
Install Protoc: outcome=success; conclusion=success
Cargo nextest run (core): success

Failure-signature scrape: clean. The action emitted one upstream Node url.parse() deprecation warning; it did not affect setup or execution.

Verdict: PASS

Doc-reconciliation: clean

[Copilot]

Pull request overview

This PR hardens CI’s protoc installation step by authenticating GitHub release discovery on github.com (to avoid shared-runner API rate limiting) while keeping behavior safe/anonymous on GitHub Enterprise Server.

Changes:

• Pin arduino/setup-protoc to the verified v3.0.0 commit SHA.
• Pass the built-in job token only when github.server_url is https://github.com to avoid using an invalid token on GHES.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[intel352]

Refreshing current required checks at exact head 884110e per locked Task 4d; reopening immediately.