feat: add sticky PR drift diff comments, Node 24 runtime, and CI fixes

.github/linters/.eslintrc.yml

@@ -5,8 +5,10 @@ env:
   node: true
 
 globals:
+  AbortSignal: readonly
   Atomics: readonly
   SharedArrayBuffer: readonly
+  fetch: readonly
 
 ignorePatterns:
   - '!.*'

.github/workflows/check-dist.yml

@@ -1,11 +1,3 @@
-# In JavaScript actions, `dist/index.js` is a special file. When you reference
-# an action with `uses:`, `dist/index.js` is the code that will be run. For this
-# project, the `dist/index.js` file is generated from other source files through
-# the build process. We need to make sure that the checked-in `dist/index.js`
-# file matches what is expected from the build.
-#
-# This workflow will fail if the checked-in `dist/index.js` file does not match
-# what is expected from the build.
 name: Check dist/
 
 on:
@@ -31,12 +23,12 @@ jobs:
     steps:
       - name: Checkout
         id: checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Setup Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v6
         with:
-          node-version: 20
+          node-version: 24
           cache: npm
 
       - name: Install Dependencies
@@ -56,9 +48,7 @@ jobs:
             exit 1
           fi
 
-      # If index.js was different than expected, upload the expected version as
-      # a workflow artifact.
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v6
         if: ${{ failure() && steps.diff.conclusion == 'failure' }}
         with:
           name: dist

.github/workflows/ci.yml

@@ -15,13 +15,13 @@ jobs:
     steps:
       - name: Checkout
         id: checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Setup Node.js
         id: setup-node
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v6
         with:
-          node-version: 20
+          node-version: 24
           cache: npm
 
       - name: Install Dependencies
@@ -47,25 +47,28 @@ jobs:
     steps:
       - name: Checkout
         id: checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
-      - name: Test Local Action
+      - name: Test Local Action (Pinned Version)
         id: test-action
         uses: ./
         with:
-          version: v0.5.0
+          version: v0.16.0
 
-      - name: Check pbuf cli
+      - name: Check pbuf CLI
         id: check-pbuf-cli
-        run: pbuf init pbuf/pbuf-setup-action
+        run: |
+          mkdir -p /tmp/pbuf-smoke && cd /tmp/pbuf-smoke
+          pbuf init pbufio/pbuf-setup-action
+          test -f pbuf.yaml
 
-      - name: Test Local Action With Config
+      - name: Test Local Action With Auth Token (Latest)
         id: test-action-with-config
         uses: ./
         with:
-          version: v0.5.0
+          version: latest
           pbuf_token: "hello_token"
 
       - name: Check .netrc
         id: check-netrc
-        run: cat ~/.netrc
+        run: test -s ~/.netrc

.github/workflows/codeql-analysis.yml

@@ -1,21 +1,9 @@
-# For most projects, this workflow file will not need changing; you simply need
-# to commit it to your repository.
-#
-# You may wish to alter this file to override the set of languages analyzed,
-# or to provide custom queries or build logic.
-#
-# ******** NOTE ********
-# We have attempted to detect the languages in your repository. Please check
-# the `language` matrix defined below to confirm you have the correct set of
-# supported CodeQL languages.
-#
 name: "CodeQL"
 
 on:
   push:
     branches: [ main ]
   pull_request:
-    # The branches below must be a subset of the branches above
     branches: [ main ]
   schedule:
     - cron: '24 5 * * 6'
@@ -33,39 +21,19 @@ jobs:
       fail-fast: false
       matrix:
         language: [ 'javascript' ]
-        # CodeQL supports [ 'cpp', 'csharp', 'go', 'java', 'javascript', 'python', 'ruby' ]
-        # Learn more about CodeQL language support at https://git.io/codeql-language-support
 
     steps:
-    - name: Checkout repository
-      uses: actions/checkout@v4
+      - name: Checkout repository
+        uses: actions/checkout@v6
 
-    # Initializes the CodeQL tools for scanning.
-    - name: Initialize CodeQL
-      uses: github/codeql-action/init@v2
-      with:
-        languages: ${{ matrix.language }}
-        config-file: ./.github/codeql/codeql-config.yml
-        # If you wish to specify custom queries, you can do so here or in a config file.
-        # By default, queries listed here will override any specified in a config file.
-        # Prefix the list here with "+" to use these queries and those in the config file.
-        # queries: ./path/to/local/query, your-org/your-repo/queries@main
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@v4
+        with:
+          languages: ${{ matrix.language }}
+          config-file: ./.github/codeql/codeql-config.yml
 
-    # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
-    # If this step fails, then you should remove it and run the build manually (see below)
-    - name: Autobuild
-      uses: github/codeql-action/autobuild@v2
+      - name: Autobuild
+        uses: github/codeql-action/autobuild@v4
 
-    # ℹ️ Command-line programs to run using the OS shell.
-    # 📚 https://git.io/JvXDl
-
-    # ✏️ If the Autobuild fails above, remove it and uncomment the following three lines
-    #    and modify them (or add more) to build your code if your project
-    #    uses a compiled language
-
-    #- run: |
-    #   make bootstrap
-    #   make release
-
-    - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@v2
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@v4

README.md

@@ -1,38 +1,78 @@
 # `pbuf-setup`
 
 ## Overview
-The `pbuf-setup` GitHub Action is designed to install `pbuf-cli`, a command-line interface tool, for use in other jobs within a GitHub Actions workflow. 
+The `pbuf-setup` GitHub Action installs the `pbuf` CLI on Linux and macOS runners, configures registry authentication, and optionally runs `pbuf drift diff` on pull requests with a sticky Markdown summary comment.
 
 ## Requirements
-- GitHub Actions runner with either Linux or Darwin operating system.
-- Architecture must be either AMD64 or ARM64.
-
-## Features
-- **Version Control**: Specify the desired version of `pbuf-cli` to be installed.
-- **Platform Compatibility Check**: Ensures compatibility with Linux and Darwin operating systems and AMD64 or ARM64 architectures.
-- **Automatic Download and Installation**: Downloads and installs `pbuf-cli` automatically to the runner's environment.
-- **Token Auth Support**: Supports usage of a `pbuf_token` for operations requiring authentication with the PBUF registry.
+- GitHub Actions runner with Linux or macOS (`darwin`).
+- Architecture: `amd64` (`x86_64`) or `arm64` (`aarch64`).
 
 ## Inputs
-- **`version`**: The version of the CLI to install. The default is 'v0.9.0'. This input is optional.
-- **`pbuf_token`**: The API token for authenticating with the PBUF registry. This input is optional.
+
+| Input | Required | Default | Description |
+| :--- | :--- | :--- | :--- |
+| `version` | No | `'v0.16.0'` | Version of `pbuf` CLI to install (for example `'v0.16.0'` or `'latest'`). |
+| `pbuf_token` | No | `''` | API token for authenticating with the PBUF registry (`pbuf auth`). |
+| `drift_diff` | No | `'false'` | When `'true'`, runs `pbuf drift diff --format=markdown` against the registry baseline. |
+| `fail_on` | No | `'critical'` | Severity threshold to fail drift checks (`critical`, `warning`, `info`, or `none`). |
+| `against` | No | `''` | Baseline registry tag to compare against (defaults to the latest published tag). |
+| `working_directory` | No | `''` | Directory containing `pbuf.yaml` when running `pbuf drift diff`. |
+| `comment_on_pr` | No | `'false'` | When `'true'` on `pull_request` events, posts or updates a single sticky PR comment (`<!-- pbuf-drift-diff -->`) with the Markdown report. |
+| `github_token` | No | `${{ github.token }}` | GitHub token used to post or update sticky PR comments (requires `pull-requests: write`). |
+
+## Outputs
+
+| Output | Description |
+| :--- | :--- |
+| `drift_markdown` | Markdown report generated by `pbuf drift diff`. |
+| `drift_exit_code` | Exit code returned by `pbuf drift diff`. |
 
 ## Usage
-To use this action, include it in your workflow `.yml` file with the necessary inputs. Below is a sample configuration:
 
-```yml
+### Install CLI and Push Modules on Tag
+
+```yaml
 steps:
-- name: Install pbuf-cli
-  uses: pbufio/[email protected]
-  with:
-    version: 'v0.9.0' # Optional. Specify the desired version
-    pbuf_token: ${{ secrets.PBUF_TOKEN }} # Optional, your PBUF API token
-
-- name: Register Module
-  id: pbuf-register
-  run: pbuf modules register
-
-- name: Push Module
-  id: pbuf-push
-  run: pbuf modules push ${{ github.ref_name }}
+  - uses: actions/checkout@v6
+
+  - name: Install pbuf CLI
+    uses: pbufio/pbuf-setup-action@v1
+    with:
+      version: 'v0.16.0'
+      pbuf_token: ${{ secrets.PBUF_TOKEN }}
+
+  - name: Register and Push Module
+    run: |
+      pbuf modules register
+      pbuf modules push ${{ github.ref_name }}
+```
+
+### Pull Request Schema Drift Check with Sticky PR Comment
+
+```yaml
+name: Schema Drift Check
+
+on:
+  pull_request:
+    paths:
+      - '**.proto'
+      - 'pbuf.yaml'
+
+permissions:
+  contents: read
+  pull-requests: write
+
+jobs:
+  drift-diff:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+
+      - name: Check Schema Drift
+        uses: pbufio/pbuf-setup-action@v1
+        with:
+          pbuf_token: ${{ secrets.PBUF_TOKEN }}
+          drift_diff: true
+          fail_on: critical
+          comment_on_pr: true
 ```