Adds a new `protofmt` CI component that validates `.proto` files are correctly
formatted using `clang-format --style=Google`.

The job formats all `.proto` files in-place, then uses `git diff` to detect any
changes. On failure, the diff is printed to stdout and exposed as a
downloadable `protofmt.patch` artifact so users can apply it directly with
`patch -p1`.

The component accepts an `allow_failure` boolean input (default: false), useful
when introducing the check to a project that has not yet been fully formatted.

Issue: gitlab-com/gl-infra/platform/runway/team#919

By default, curl isn't installed but is needed
for the curl command used inside.

feat: Add protofmt CI component for Protocol Buffer formatting.

See merge request !1525

## [4.5.0](https://gitlab.com/gitlab-com/gl-infra/common-ci-tasks/-/compare/...) (2026-05-29)

### Features

* Add protofmt CI component for Protocol Buffer formatting. ([a27969a6](a27969a6)), closes [gitlab-com/gl-infra/platform/runway/team#919](https://gitlab.com/gitlab-com/gl-infra/platform/runway/team/-/issues/)

Finding 1: SYNC_TYPE auto-detection was always returning manual because
generate-publish-pipeline used CI_JOB_TOKEN to check canonical's commit/tag
API endpoints. Job tokens are scoped to the originating project and cannot
access cross-project endpoints, so both checks returned 401. Fix: use
CANONICAL_REPO_TOKEN (PRIVATE-TOKEN header) for canonical API calls, and
add a guard that falls back to manual when the token is absent.

Finding 2: sync-commits (and sync-default-branch) pushed to canonical using
`http.extraHeader: PRIVATE-TOKEN: <token>`. This works for PATs but not for
Group Service Account Access Tokens (SAATs), which require HTTP Basic auth.
Fix: construct Basic auth credentials from CANONICAL_REPO_TOKEN_USERNAME +
CANONICAL_REPO_TOKEN via `printf '%s:%s' ... | base64`.

Also fixes the same cross-project JOB-TOKEN issue in sync-default-branch's
canonical API calls (default branch detection and branch head comparison).

Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>

Add explicit guard before Basic auth construction in sync-commits and
sync-default-branch: if CANONICAL_REPO_TOKEN_USERNAME or CANONICAL_REPO_TOKEN
is unset, fail immediately with a clear error rather than silently producing
a malformed ':token' credential that causes a confusing 401/403.

Add manitest for the CANONICAL_REPO_TOKEN absent fallback path in
generate-publish-pipeline so the elif guard is protected against future
regressions.

Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>

fix(release-platform): fix SYNC_TYPE detection and git push auth for SAATs

See merge request !1545

## [4.5.1](https://gitlab.com/gitlab-com/gl-infra/common-ci-tasks/-/compare/...) (2026-05-29)

### Fixes

* **release-platform:** fix SYNC_TYPE detection and git push auth for SAATs ([3ca16413](3ca16413))
* **release-platform:** validate CANONICAL_REPO_TOKEN_USERNAME; add test for token-absent guard ([fcfb1f92](fcfb1f92))

fix(helm-publish): install curl before running

See merge request !1539

## [4.5.2](https://gitlab.com/gitlab-com/gl-infra/common-ci-tasks/-/compare/...) (2026-06-01)

### Fixes

* **helm-publish:** install curl before running ([6381250c](6381250c))

chore(deps): update pre-commit hook gitlab-com/gl-infra/common-ci-tasks to v4.5

See merge request !1538

chore(deps): update dependency gitlab-com/gl-infra/platform/runway/runwayctl to v4.42.0

See merge request !1543

chore(deps): update dependency gitlab-com/gl-infra/platform/runway/fairway to v1.20.0

See merge request !1534

The SYNC_TYPE=auto gate previously required both the commit SHA and the
release tag to exist on canonical. For canonical-originated releases,
the commit is already on canonical (mirrored there), but the release tag
is created by the security mirror's goreleaser and does not exist on
canonical until sync-commits pushes it. This caused SYNC_TYPE to always
fall back to "manual" even though no human gate is needed.

Three changes:
1. SYNC_TYPE detection: check only the commit SHA. If the commit is on
   canonical the release originated there; SYNC_TYPE=auto. Tag presence
   is still logged for diagnostics but does not affect the decision.
2. sync-commits is now always generated (previously gated on
   SYNC_TYPE=manual). It is already idempotent -- it skips the tag push
   when the tag already exists. Removing the conditional lets it push
   the tag automatically in the auto path.
3. sync-default-branch: change hardcoded `when: manual` to
   `when: ${SYNC_WHEN}` so it also runs automatically when
   SYNC_TYPE=auto. The job is already idempotent (exits 0 when branches
   are already aligned).

Root cause identified from v1.5.0 security pipeline 2567475075:
  "Commit exists on canonical but tag v1.5.0 does not (HTTP 404)"
  The canonical tag pipeline started at 14:15:51 -- 10 minutes after
  generate-publish-pipeline ran its check at 14:05:16.

Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>

fix(release-platform): auto-sync when commit exists on canonical regardless of tag

See merge request !1550

## [4.5.3](https://gitlab.com/gitlab-com/gl-infra/common-ci-tasks/-/compare/...) (2026-06-01)

### Fixes

* **release-platform:** auto-sync when commit exists on canonical regardless of tag ([ad71206e](ad71206e))

### Dependencies

* **deps:** update dependency gitlab-com/gl-infra/platform/runway/fairway to v1.20.0 ([405e9d2a](405e9d2a))
* **deps:** update dependency gitlab-com/gl-infra/platform/runway/runwayctl to v4.42.0 ([29b352b8](29b352b8))
* **deps:** update pre-commit hook gitlab-com/gl-infra/common-ci-tasks to v4.5 ([221c04de](221c04de))