From 0cffeb6ab6a8b20c6e261cf645d92736a44e021f Mon Sep 17 00:00:00 2001
From: Sofia Leon <sofialeon@google.com>
Date: Wed, 27 May 2026 21:39:37 +0000
Subject: [PATCH 1/2] ci: add librarian library generation workflow

Create a new GitHub workflow librarian_library_generation.yaml to run
librarian generate --all on PRs and verify that the output is identical
to the checked-in code.

Fixes https://github.com/googleapis/librarian/issues/5240
---
 .../librarian_library_generation.yaml         | 92 +++++++++++++++++++
 1 file changed, 92 insertions(+)
 create mode 100644 .github/workflows/librarian_library_generation.yaml

diff --git a/.github/workflows/librarian_library_generation.yaml b/.github/workflows/librarian_library_generation.yaml
new file mode 100644
index 000000000000..f9ac2d21fe6d
--- /dev/null
+++ b/.github/workflows/librarian_library_generation.yaml
@@ -0,0 +1,92 @@
+# Copyright 2026 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+name: Librarian library generation upon generation config change through pull requests
+on:
+  pull_request:
+
+env:
+  REPO_FULL_NAME: ${{ github.event.pull_request.head.repo.full_name }}
+  GITHUB_REPOSITORY: ${{ github.repository }}
+
+jobs:
+  library_generation:
+    runs-on: ubuntu-24.04
+    steps:
+    - name: Determine whether the pull request comes from a fork
+      run: |
+        if [[ "${GITHUB_REPOSITORY}" != "${REPO_FULL_NAME}" ]]; then
+          echo "This PR comes from a fork. Skip library generation."
+          echo "SHOULD_RUN=false" >> $GITHUB_ENV
+        else
+          echo "SHOULD_RUN=true" >> $GITHUB_ENV
+        fi
+    - uses: actions/checkout@v4
+      if: env.SHOULD_RUN == 'true'
+      with:
+        fetch-depth: 0
+        token: ${{ secrets.CLOUD_JAVA_BOT_GITHUB_TOKEN }}
+    - uses: actions/setup-go@v5
+      if: env.SHOULD_RUN == 'true'
+      with:
+        go-version: 'stable'
+    - name: Install Librarian
+      if: env.SHOULD_RUN == 'true'
+      run: |
+        LIBRARIAN_VERSION=$(grep "^version:" librarian.yaml | cut -d':' -f2 | xargs)
+        echo "Installing librarian version $LIBRARIAN_VERSION"
+        go install github.com/googleapis/librarian/cmd/librarian@$LIBRARIAN_VERSION
+    - name: Install protoc
+      if: env.SHOULD_RUN == 'true'
+      run: |
+        set -e
+        VERSION="31.0"
+        curl -fsSL --retry 5 --retry-delay 15 -o /tmp/protoc.zip "https://github.com/protocolbuffers/protobuf/releases/download/v$VERSION/protoc-$VERSION-linux-x86_64.zip"
+        cd /usr/local
+        sudo unzip -o /tmp/protoc.zip
+        protoc --version
+    - uses: actions/setup-java@v4
+      if: env.SHOULD_RUN == 'true'
+      with:
+        java-version: "17"
+        distribution: "temurin"
+        cache: "maven"
+    - name: Verify Java and Maven installation
+      if: env.SHOULD_RUN == 'true'
+      run: |
+        java -version
+        if ! command -v mvn &> /dev/null; then
+          sudo apt-get update && sudo apt-get install -y maven
+        fi
+        mvn -version
+    - uses: actions/setup-python@v5
+      if: env.SHOULD_RUN == 'true'
+      with:
+        python-version: "3.12"
+        cache: 'pip'
+    - name: Run librarian install
+      if: env.SHOULD_RUN == 'true'
+      run: |
+        librarian install
+        echo "$HOME/java_tools/bin" >> $GITHUB_PATH
+    - name: Run librarian generate
+      if: env.SHOULD_RUN == 'true'
+      env:
+        PYTHONPATH: ${{ github.workspace }}/sdk-platform-java/hermetic_build/library_generation/owlbot
+      run: |
+        librarian generate --all
+    - name: Check for generated code changes
+      if: env.SHOULD_RUN == 'true'
+      run: |
+        # Fail if librarian generate produced any diff against the checked out code (which was generated by hermetic build)
+        git diff --exit-code

From 4135b455d112f24e93119ad01ba10a0c8b62f624 Mon Sep 17 00:00:00 2001
From: sofisl <55454395+sofisl@users.noreply.github.com>
Date: Thu, 28 May 2026 11:09:18 -0700
Subject: [PATCH 2/2] Update librarian installation and protoc version

---
 .github/workflows/librarian_library_generation.yaml | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/librarian_library_generation.yaml b/.github/workflows/librarian_library_generation.yaml
index f9ac2d21fe6d..e46c712316da 100644
--- a/.github/workflows/librarian_library_generation.yaml
+++ b/.github/workflows/librarian_library_generation.yaml
@@ -43,14 +43,14 @@ jobs:
     - name: Install Librarian
       if: env.SHOULD_RUN == 'true'
       run: |
-        LIBRARIAN_VERSION=$(grep "^version:" librarian.yaml | cut -d':' -f2 | xargs)
-        echo "Installing librarian version $LIBRARIAN_VERSION"
-        go install github.com/googleapis/librarian/cmd/librarian@$LIBRARIAN_VERSION
+        V=$(go run github.com/googleapis/librarian/cmd/librarian@latest config get version)
+        echo "Installing librarian version $V"
+        go install github.com/googleapis/librarian/cmd/librarian@$V
     - name: Install protoc
       if: env.SHOULD_RUN == 'true'
       run: |
         set -e
-        VERSION="31.0"
+        VERSION="33.2"
         curl -fsSL --retry 5 --retry-delay 15 -o /tmp/protoc.zip "https://github.com/protocolbuffers/protobuf/releases/download/v$VERSION/protoc-$VERSION-linux-x86_64.zip"
         cd /usr/local
         sudo unzip -o /tmp/protoc.zip