From 2ec2581da10798e679af753a8c7ad961ed06fb80 Mon Sep 17 00:00:00 2001
From: Colin Moy <colinmoy@google.com>
Date: Fri, 21 Aug 2026 19:57:22 +0000
Subject: [PATCH 1/5] feat(generator): automate compute discovery document
 updates

---
 .../workflows/update-compute-discovery.yml    | 48 +++++++++++++++++++
 generator/discovery/update_discovery_doc.sh   | 23 +++++++--
 2 files changed, 68 insertions(+), 3 deletions(-)
 create mode 100644 .github/workflows/update-compute-discovery.yml

diff --git a/.github/workflows/update-compute-discovery.yml b/.github/workflows/update-compute-discovery.yml
new file mode 100644
index 0000000000000..e99d496cd2809
--- /dev/null
+++ b/.github/workflows/update-compute-discovery.yml
@@ -0,0 +1,48 @@
+name: Update Compute Discovery Document
+
+on:
+  schedule:
+    # Runs every Monday at 09:00 UTC
+    - cron: '0 9 * * 1'
+  workflow_dispatch: # Allows manual trigger from the GitHub Actions UI
+
+permissions:
+  contents: write
+  pull-requests: write
+
+jobs:
+  update-compute-discovery:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Setup Git user identity
+        run: |
+          git config user.name "cloud-cpp-automation[bot]"
+          git config user.email "cloud-cpp-automation[bot]@users.noreply.github.com"
+
+      - name: Run update_discovery_doc.sh
+        run: |
+          ./generator/discovery/update_discovery_doc.sh --no-create-branch
+
+      - name: Run checkers
+        run: |
+          ci/cloudbuild/build.sh -t checkers-pr
+
+      - name: Create Pull Request if changes exist
+        uses: peter-evans/create-pull-request@v6
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
+          commit-message: "feat(compute): update discovery doc and generate new services"
+          branch: "automation/update-compute-discovery"
+          delete-branch: true
+          title: "feat(compute): update discovery doc and generate new services"
+          body: |
+            Automated update of Compute Engine Discovery Document and generated C++ client code.
+            
+            Triggered automatically by the `update-compute-discovery` workflow.
+          labels: |
+            autorelease: pending
\ No newline at end of file
diff --git a/generator/discovery/update_discovery_doc.sh b/generator/discovery/update_discovery_doc.sh
index 31794d8e7b567..1262b102ea409 100755
--- a/generator/discovery/update_discovery_doc.sh
+++ b/generator/discovery/update_discovery_doc.sh
@@ -86,11 +86,28 @@ readonly GENERATOR_CONFIG_RELATIVE_PATH="generator/generator_config.textproto"
 readonly COMPUTE_SERVICE_DIRS_CMAKE_RELATIVE_PATH="google/cloud/compute/service_dirs.cmake"
 readonly COMPUTE_SERVICE_DIRS_BZL_RELATIVE_PATH="google/cloud/compute/service_dirs.bzl"
 
-io::log_h2 "Fetching discovery document from ${COMPUTE_DISCOVERY_DOCUMENT_URL}"
-curl "${COMPUTE_DISCOVERY_DOCUMENT_URL}" >"${PROJECT_ROOT}/${COMPUTE_DISCOVERY_JSON_RELATIVE_PATH}"
+CURRENT_REVISION=$(sed -En 's/  \"revision\": \"([[:digit:]]+)\",/\1/p' "${PROJECT_ROOT}/${COMPUTE_DISCOVERY_JSON_RELATIVE_PATH}" 2>/dev/null || echo "")
 
-REVISION=$(sed -En 's/  \"revision\": \"([[:digit:]]+)\",/\1/p' "${PROJECT_ROOT}/${COMPUTE_DISCOVERY_JSON_RELATIVE_PATH}")
+io::log_h2 "Fetching discovery document from ${COMPUTE_DISCOVERY_DOCUMENT_URL}"
+TEMP_JSON=$(mktemp)
+trap 'rm -f "${TEMP_JSON}"' EXIT
+curl -fsSL "${COMPUTE_DISCOVERY_DOCUMENT_URL}" >"${TEMP_JSON}"
+
+REVISION=$(sed -En 's/  \"revision\": \"([[:digit:]]+)\",/\1/p' "${TEMP_JSON}")
+if [[ -z "${REVISION}" ]]; then
+  io::log_red "Could not parse revision from fetched discovery document."
+  exit 1
+fi
 readonly REVISION
+
+if [[ -n "${CURRENT_REVISION}" && "${REVISION}" == "${CURRENT_REVISION}" ]]; then
+  io::log_green "Compute discovery document is already up to date (revision ${CURRENT_REVISION}). Nothing to do."
+  exit 0
+fi
+
+io::log_h2 "Updating Discovery Document: ${CURRENT_REVISION:-none} -> ${REVISION}"
+mv "${TEMP_JSON}" "${PROJECT_ROOT}/${COMPUTE_DISCOVERY_JSON_RELATIVE_PATH}"
+
 if [[ "${CREATE_BRANCH}" == "true" ]]; then
   io::run git checkout -B update_compute_discovery_circa_"${REVISION}"
 fi

From 394936bd97bac3238f6929b985e642def91f18d9 Mon Sep 17 00:00:00 2001
From: colinmoy <111095719+colinmoy@users.noreply.github.com>
Date: Fri, 21 Aug 2026 13:03:19 -0700
Subject: [PATCH 2/5] Update generator/discovery/update_discovery_doc.sh

Co-authored-by: gemini-code-assist[bot] <176961590+gemini-code-assist[bot]@users.noreply.github.com>
---
 generator/discovery/update_discovery_doc.sh | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/generator/discovery/update_discovery_doc.sh b/generator/discovery/update_discovery_doc.sh
index 1262b102ea409..b6f19e847dcd5 100755
--- a/generator/discovery/update_discovery_doc.sh
+++ b/generator/discovery/update_discovery_doc.sh
@@ -90,8 +90,16 @@ CURRENT_REVISION=$(sed -En 's/  \"revision\": \"([[:digit:]]+)\",/\1/p' "${PROJE
 
 io::log_h2 "Fetching discovery document from ${COMPUTE_DISCOVERY_DOCUMENT_URL}"
 TEMP_JSON=$(mktemp)
+if [[ ! -f "${TEMP_JSON}" ]]; then
+  io::log_red "Failed to create temporary file."
+  exit 1
+fi
 trap 'rm -f "${TEMP_JSON}"' EXIT
-curl -fsSL "${COMPUTE_DISCOVERY_DOCUMENT_URL}" >"${TEMP_JSON}"
+
+if ! curl -fsSL "${COMPUTE_DISCOVERY_DOCUMENT_URL}" >"${TEMP_JSON}"; then
+  io::log_red "Failed to fetch discovery document from ${COMPUTE_DISCOVERY_DOCUMENT_URL}"
+  exit 1
+fi
 
 REVISION=$(sed -En 's/  \"revision\": \"([[:digit:]]+)\",/\1/p' "${TEMP_JSON}")
 if [[ -z "${REVISION}" ]]; then

From 33700c1bc7048db9e02184b954c73813376ecb7e Mon Sep 17 00:00:00 2001
From: Colin Moy <colinmoy@google.com>
Date: Fri, 21 Aug 2026 20:15:46 +0000
Subject: [PATCH 3/5] chore: apply formatting from checkers

---
 .github/workflows/update-compute-discovery.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/update-compute-discovery.yml b/.github/workflows/update-compute-discovery.yml
index e99d496cd2809..19985c28d261f 100644
--- a/.github/workflows/update-compute-discovery.yml
+++ b/.github/workflows/update-compute-discovery.yml
@@ -42,7 +42,7 @@ jobs:
           title: "feat(compute): update discovery doc and generate new services"
           body: |
             Automated update of Compute Engine Discovery Document and generated C++ client code.
-            
+
             Triggered automatically by the `update-compute-discovery` workflow.
           labels: |
-            autorelease: pending
\ No newline at end of file
+            autorelease: pending

From e9058b5db26c251496343dc290ba032723e1811c Mon Sep 17 00:00:00 2001
From: Colin Moy <colinmoy@google.com>
Date: Fri, 21 Aug 2026 20:56:51 +0000
Subject: [PATCH 4/5] feat(ci): use native gh cli to create automation pr

---
 .../workflows/update-compute-discovery.yml    | 40 ++++++++++++-------
 1 file changed, 26 insertions(+), 14 deletions(-)

diff --git a/.github/workflows/update-compute-discovery.yml b/.github/workflows/update-compute-discovery.yml
index 19985c28d261f..548cbb0212dfc 100644
--- a/.github/workflows/update-compute-discovery.yml
+++ b/.github/workflows/update-compute-discovery.yml
@@ -32,17 +32,29 @@ jobs:
         run: |
           ci/cloudbuild/build.sh -t checkers-pr
 
-      - name: Create Pull Request if changes exist
-        uses: peter-evans/create-pull-request@v6
-        with:
-          token: ${{ secrets.GITHUB_TOKEN }}
-          commit-message: "feat(compute): update discovery doc and generate new services"
-          branch: "automation/update-compute-discovery"
-          delete-branch: true
-          title: "feat(compute): update discovery doc and generate new services"
-          body: |
-            Automated update of Compute Engine Discovery Document and generated C++ client code.
-
-            Triggered automatically by the `update-compute-discovery` workflow.
-          labels: |
-            autorelease: pending
+      - name: Push branch and create Pull Request if changes exist
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          # Check if a new commit was made (HEAD differs from origin/main)
+          if [[ "$(git rev-parse HEAD)" != "$(git rev-parse origin/main)" ]]; then
+            echo "Changes detected. Pushing branch automation/update-compute-discovery..."
+            git push origin HEAD:automation/update-compute-discovery --force
+
+            echo "Checking if a PR is already open..."
+            if ! gh pr list --head "automation/update-compute-discovery" --json number -q '.[0].number' | grep -q '^[0-9]'; then
+              echo "Opening new PR..."
+              gh pr create \
+                --title "feat(compute): update discovery doc and generate new services" \
+                --body "Automated update of Compute Engine Discovery Document and generated C++ client code.
+
+Triggered automatically by the \`update-compute-discovery\` workflow." \
+                --base main \
+                --head automation/update-compute-discovery \
+                --label "autorelease: pending"
+            else
+              echo "Pull request already exists for automation/update-compute-discovery. Branch has been updated."
+            fi
+          else
+            echo "No changes committed. Nothing to push or create."
+          fi

From 9234e5bbddb27cac7f0804519fd3d78926914cb1 Mon Sep 17 00:00:00 2001
From: Colin Moy <colinmoy@google.com>
Date: Fri, 21 Aug 2026 22:49:58 +0000
Subject: [PATCH 5/5] fix(ci): fix yaml syntax and address zizmor security
 findings

---
 .github/workflows/update-compute-discovery.yml | 14 ++++++++------
 1 file changed, 8 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/update-compute-discovery.yml b/.github/workflows/update-compute-discovery.yml
index 548cbb0212dfc..f2cfa5241324a 100644
--- a/.github/workflows/update-compute-discovery.yml
+++ b/.github/workflows/update-compute-discovery.yml
@@ -7,17 +7,20 @@ on:
   workflow_dispatch: # Allows manual trigger from the GitHub Actions UI
 
 permissions:
-  contents: write
-  pull-requests: write
+  contents: read
 
 jobs:
   update-compute-discovery:
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      pull-requests: write
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           fetch-depth: 0
+          persist-credentials: false
 
       - name: Setup Git user identity
         run: |
@@ -44,11 +47,10 @@ jobs:
             echo "Checking if a PR is already open..."
             if ! gh pr list --head "automation/update-compute-discovery" --json number -q '.[0].number' | grep -q '^[0-9]'; then
               echo "Opening new PR..."
+              BODY="Automated update of Compute Engine Discovery Document and generated C++ client code.\n\nTriggered automatically by the \`update-compute-discovery\` workflow."
               gh pr create \
                 --title "feat(compute): update discovery doc and generate new services" \
-                --body "Automated update of Compute Engine Discovery Document and generated C++ client code.
-
-Triggered automatically by the \`update-compute-discovery\` workflow." \
+                --body "$(printf '%b' "$BODY")" \
                 --base main \
                 --head automation/update-compute-discovery \
                 --label "autorelease: pending"