From 2b56a6793fee450916f4da854385ccdbc798fe28 Mon Sep 17 00:00:00 2001
From: rulex123 <erica.manno@gmail.com>
Date: Fri, 30 Oct 2026 09:59:20 +0100
Subject: [PATCH] ci: report proto update failures at their source

Signed-off-by: rulex123 <erica.manno@gmail.com>
---
 .github/workflows/update-protobuf.yml |  1 +
 tools/update-api.sh                   | 14 +++++++-------
 tools/update-sha.sh                   |  4 ++--
 3 files changed, 10 insertions(+), 9 deletions(-)

diff --git a/.github/workflows/update-protobuf.yml b/.github/workflows/update-protobuf.yml
index 75f2e6a0e..d4e96866b 100644
--- a/.github/workflows/update-protobuf.yml
+++ b/.github/workflows/update-protobuf.yml
@@ -20,6 +20,7 @@ jobs:
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
       - name: Run scripts
+        shell: bash
         working-directory: ./tools/
         run: |
           ./update-sha.sh ${{ inputs.envoy_version }} | tee API_SHAS
diff --git a/tools/update-api.sh b/tools/update-api.sh
index 78b9619df..e0686f1bc 100755
--- a/tools/update-api.sh
+++ b/tools/update-api.sh
@@ -29,11 +29,11 @@ pushd "${tmpdir}" >/dev/null
 
 rm -rf "${protodir}"
 
-curl -sL https://github.com/envoyproxy/envoy/archive/${ENVOY_SHA}.tar.gz | tar xz --wildcards '*.proto'
+curl -fsSL https://github.com/envoyproxy/envoy/archive/${ENVOY_SHA}.tar.gz | tar xz --wildcards '*.proto'
 mkdir -p "${protodir}/envoy"
 cp -r envoy-*/api/envoy/* "${protodir}/envoy"
 
-curl -sL https://github.com/googleapis/googleapis/archive/${GOOGLEAPIS_SHA}.tar.gz | tar xz --wildcards '*.proto'
+curl -fsSL https://github.com/googleapis/googleapis/archive/${GOOGLEAPIS_SHA}.tar.gz | tar xz --wildcards '*.proto'
 mkdir -p "${protodir}/google/api"
 mkdir -p "${protodir}/google/api/expr/v1alpha1"
 mkdir -p "${protodir}/google/rpc"
@@ -42,25 +42,25 @@ cp googleapis-*/google/api/expr/v1alpha1/syntax.proto "${protodir}/google/api/ex
 cp googleapis-*/google/api/expr/v1alpha1/checked.proto "${protodir}/google/api/expr/v1alpha1"
 cp googleapis-*/google/rpc/status.proto "${protodir}/google/rpc"
 
-curl -sL https://github.com/envoyproxy/protoc-gen-validate/archive/v${PGV_VERSION}.tar.gz | tar xz --wildcards '*.proto'
+curl -fsSL https://github.com/envoyproxy/protoc-gen-validate/archive/v${PGV_VERSION}.tar.gz | tar xz --wildcards '*.proto'
 mkdir -p "${protodir}/validate"
 cp -r protoc-gen-validate-*/validate/* "${protodir}/validate"
 
-curl -sL https://github.com/prometheus/client_model/archive/v${PROMETHEUS_SHA}.tar.gz | tar xz --wildcards '*.proto'
+curl -fsSL https://github.com/prometheus/client_model/archive/v${PROMETHEUS_SHA}.tar.gz | tar xz --wildcards '*.proto'
 mkdir -p "${protodir}/io/prometheus/client/"
 cp client_model-*/io/prometheus/client/metrics.proto "${protodir}/io/prometheus/client/"
 
-curl -sL https://github.com/cncf/xds/archive/${XDS_SHA}.tar.gz | tar xz --wildcards '*.proto'
+curl -fsSL https://github.com/cncf/xds/archive/${XDS_SHA}.tar.gz | tar xz --wildcards '*.proto'
 mkdir -p "${protodir}/udpa"
 mkdir -p "${protodir}/xds"
 cp -r xds-*/udpa/* "${protodir}/udpa"
 cp -r xds-*/xds/* "${protodir}/xds"
 
-curl -sL https://github.com/open-telemetry/opentelemetry-proto/archive/v${OPENTELEMETRY_VERSION}.tar.gz | tar xz --wildcards '*.proto'
+curl -fsSL https://github.com/open-telemetry/opentelemetry-proto/archive/v${OPENTELEMETRY_VERSION}.tar.gz | tar xz --wildcards '*.proto'
 mkdir -p "${protodir}/opentelemetry/proto"
 cp -r opentelemetry-proto-*/opentelemetry/proto/* "${protodir}/opentelemetry/proto"
 
-curl -sL https://github.com/google/cel-spec/archive/v${CEL_VERSION}.tar.gz | tar xz --wildcards '*.proto'
+curl -fsSL https://github.com/google/cel-spec/archive/v${CEL_VERSION}.tar.gz | tar xz --wildcards '*.proto'
 mkdir -p "${protodir}/cel/expr"
 cp -r cel-spec-*/proto/cel/expr/* "${protodir}/cel/expr"
 
diff --git a/tools/update-sha.sh b/tools/update-sha.sh
index a4fc7b324..7641ee64d 100755
--- a/tools/update-sha.sh
+++ b/tools/update-sha.sh
@@ -19,13 +19,13 @@ function find_date() {
 
 function find_envoy_sha_from_tag() {
   local TAG=$1
-  curl -s "https://api.github.com/repos/envoyproxy/envoy/commits/$TAG" | awk -F'"' '/"sha"/ && !found {print $4; found=1}'
+  curl -fsSL "https://api.github.com/repos/envoyproxy/envoy/commits/$TAG" | awk -F'"' '/"sha"/ && !found {print $4; found=1}'
 }
 
 CURRENT_ENVOY_RELEASE=$(cat envoy_release)
 ENVOY_VERSION=$(find_envoy_sha_from_tag "$1")
 
-CURL_OUTPUT=$(curl -s "https://raw.githubusercontent.com/envoyproxy/envoy/$ENVOY_VERSION/api/bazel/repository_locations.bzl")
+CURL_OUTPUT=$(curl -fsSL "https://raw.githubusercontent.com/envoyproxy/envoy/$ENVOY_VERSION/api/bazel/repository_locations.bzl")
 
 GOOGLEAPIS_SHA=$(find_sha "$CURL_OUTPUT" com_google_googleapis)
 GOOGLEAPIS_DATE=$(find_date "$CURL_OUTPUT" com_google_googleapis)