ci: publish stable protos to Buf

.agents/skills/release-captain/SKILL.md

@@ -41,6 +41,11 @@ tag, or start a second `Pre-release` run for a tag; it has no concurrency guard.
 - `Release` (`release.yml`) is dispatched by hand with the stable version. It
   picks the highest `-pre.N` on `main` whose whole `Pre-release` run passed,
   creates the stable tag on that commit, and publishes without requalifying.
+- Stable releases publish public schemas to `buf.build/openshell/core` with
+  the release tag as the label; prereleases skip Buf publication. The Buf
+  repository must exist and Actions must have a `BUF_TOKEN` secret with write
+  access. A failed Buf push fails the release run; follow Recovery before
+  rerunning the failed publication job.
 
 ## Setup
 

.github/workflows/release-publish.yml

@@ -36,6 +36,8 @@ on:
         required: true
         type: string
     secrets:
+      BUF_TOKEN:
+        required: false
       SNAPCRAFT_STORE_CREDENTIALS:
         required: false
       FERN_TOKEN:
@@ -508,6 +510,31 @@ jobs:
           retention-days: 90
           if-no-files-found: error
 
+  publish-protos:
+    name: Publish Protobuf Schemas
+    needs: release
+    if: ${{ !inputs.is-prerelease }}
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+          ref: ${{ inputs.source-sha }}
+
+      - uses: ./.github/actions/setup-nix
+
+      - name: Push release schemas to Buf
+        env:
+          BUF_TOKEN: ${{ secrets.BUF_TOKEN }}
+          SOURCE_CONTROL_URL: ${{ github.server_url }}/${{ github.repository }}/commit/${{ inputs.source-sha }}
+        run: |
+          nix develop -c \
+            buf push proto --label "${RELEASE_TAG}" \
+            --source-control-url "${SOURCE_CONTROL_URL}"
+
   publish-snap:
     name: Publish Snap
     needs: release

.github/workflows/release.yml

@@ -22,7 +22,7 @@
 concurrency:
   group: ${{ inputs.notes-only && format('release-notes-preview-{0}', github.ref) || 'release-stable' }}
   cancel-in-progress: false
   queue: max
 
 jobs:
   preview-notes:
@@ -158,6 +158,7 @@
       is-prerelease: false
       make-latest: ${{ needs.promote.outputs.make-latest == 'true' }}
     secrets:
+      BUF_TOKEN: ${{ secrets.BUF_TOKEN }}
       SNAPCRAFT_STORE_CREDENTIALS: ${{ secrets.SNAPCRAFT_STORE_CREDENTIALS }}
       FERN_TOKEN: ${{ secrets.FERN_TOKEN }}
       GITLAB_CI_TRIGGER_TOKEN: ${{ secrets.GITLAB_CI_TRIGGER_TOKEN }}

CI.md

@@ -342,6 +342,16 @@ parallel within the same run, using native job dependencies.
 Its platform package artifacts are uploaded after versioned images and the chart,
 so the installer can use them while qualification runs or after it fails.
 The pre-release snap artifact is published to the `latest/beta` channel.
+Stable release publication pushes the public `proto/` module to
+`buf.build/openshell/core`, labeled with the release tag (for example,
+`v0.1.7`) and linked to the release source commit. Prereleases do not publish
+schemas to Buf.
+The unnamed storage module under `crates/openshell-server/proto/` is excluded.
+Create the `openshell/core` repository in Buf before publishing and configure the
+GitHub Actions secret `BUF_TOKEN` with a token that can write to that repository.
+Publication runs inside the release workflow so tags created with `GITHUB_TOKEN`
+are covered; it does not depend on a separate tag-push event. A failed Buf push
+fails publication and can be retried by rerunning the failed job.
 The implemented `release-tag-v1` profile is an incremental subset of RFC 0014
 qualification. Failed checks fail the parent workflow and retain evidence in Actions.
 
@@ -691,7 +701,7 @@ These workflows run after merge to publish dev/tagged artifacts and verify them.
 | `.github/workflows/release-auto-tag.yml` | Weekdays at 14:00 Europe/Zurich, tags the next `-pre.N` on `main` when commits landed since the latest one, then dispatches Pre-release. It skips when the train has no `-pre.1` or its version is already stable, so push each train's `-pre.1` tag by hand. |
 | `.github/workflows/release-prerelease.yml` | Pre-release orchestrator, triggered by prerelease tag pushes or dispatched by Release Auto-Tag or manually. A tagless dispatch creates the next candidate on its branch; explicit tags select existing candidates. Builds, then publishes and qualifies in parallel. Qualification failure fails the run and sends the failure notification; published artifacts remain available. |
 | `.github/workflows/release-build.yml` | Shared version computation, binary and image builds, and package builds. Validates that the tag matches the caller's release kind. |
-| `.github/workflows/release-publish.yml` | Shared artifact assembly, OCI image tags and Helm chart publication, and package publication. Stable releases also publish to GitHub Releases, snap, npm, PyPI, and Fern. |
+| `.github/workflows/release-publish.yml` | Shared artifact assembly, OCI image tags and Helm chart publication, and package publication. Stable releases also publish release-labeled public schemas to Buf (`BUF_TOKEN` required), GitHub Releases, snap, npm, PyPI, and Fern. |
 | `.github/workflows/release-notes.yml` | Shared prompt-driven release notes generation through Inference Hub, used by prerelease previews, notes-only previews, and stable releases. Stable releases reuse the promoted prerelease's preview when available. |
 | `.github/workflows/release-qualification.yml` | Reusable qualification suites and result aggregation. Runs security scans, conformance and feature integration, Docker and VM E2E, protobuf compatibility, and advisory compatibility review. |
 | `.github/workflows/snap-package.yml` | Builds snap and component artifacts for Release Dev, Release, and Pre-release without Store credentials or publication. |

buf.yaml

@@ -1,14 +1,15 @@
 # SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
 # SPDX-License-Identifier: Apache-2.0
 
-# Repo-level buf module. Declares proto/ as the single module so buf generate,
+# Repo-level buf workspace. Declares public and storage modules so buf generate,
 # buf lint, buf breaking, and the editor LSP all resolve imports the same way.
 # Code generation lives with each consumer (see sdk/go/buf.gen.yaml,
-# sdk/typescript/buf.gen.yaml); this file owns the module boundary and proto
+# sdk/typescript/buf.gen.yaml); this file owns the module boundaries and proto
 # validation policy.
 version: v2
 modules:
   - path: proto
+    name: buf.build/openshell/core
   - path: crates/openshell-server/proto
 lint:
   use:

flake.nix

@@ -74,6 +74,7 @@
           yq-go
           zizmor
           zstd
+          buf
         ];
         commonDevShell = {
           packages = [ rustToolchain ] ++ commonDevShellPackages;