ci(common): update protoc setup

.github/actions/setup-rust-and-protoc/action.yml

@@ -22,14 +22,7 @@
     description: Whether to install Protoc
     required: false
     default: "true"
-  protoc-version:
-    description: Protoc version selector
-    required: false
-    default: "26.1"
-  protoc-repo-token:
-    description: Token used by setup-protoc to avoid API rate limit
-    required: false
-    default: ${{ github.token }}
+
 
 runs:
   using: composite
@@ -45,9 +38,13 @@
     - name: Install Protoc
       if: ${{ inputs.setup-protoc == 'true' }}
       env:
-        PROTOC_VERSION: ${{ inputs.protoc-version }}
-        PROTOC_REPO_TOKEN: ${{ inputs.protoc-repo-token }}
-      uses: arduino/setup-protoc@c65c819552d16ad3c9b72d9dfd5ba5237b9c906b # v3.0.0
-      with:
-        version: ${{ env.PROTOC_VERSION }}
-        repo-token: ${{ env.PROTOC_REPO_TOKEN }} # Add github token to avoid rate limit see docs https://github.com/arduino/setup-protoc
+        PROTOC_VERSION: "34.1"
+        PROTOC_SHA256: af27ea66cd26938fe48587804ca7d4817457a08350021a1c6e23a27ccc8c6904
+      shell: bash
+      run: |
+        set -euo pipefail
+        PROTOC_ARCHIVE="protoc-${PROTOC_VERSION}-linux-x86_64.zip"
+        curl -LO "https://github.com/protocolbuffers/protobuf/releases/download/v${PROTOC_VERSION}/${PROTOC_ARCHIVE}"
+        echo "${PROTOC_SHA256}  ${PROTOC_ARCHIVE}" | sha256sum --check --strict
+        unzip "${PROTOC_ARCHIVE}" -d "$HOME/.local"
+        echo "$HOME/.local/bin" >> "$GITHUB_PATH"

.github/workflows/common-testing.yml

@@ -133,8 +133,6 @@ jobs:
           rust-toolchain: ${{ env.RUST_IMAGE_VERSION }}
           rust-components: llvm-tools-preview, llvm-tools
           rust-cache: "false"
-          protoc-version: '26.1'
-          protoc-repo-token: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Setup Rust cache
         uses: Swatinem/rust-cache@779680da715d629ac1d338a641029a2f4372abb5 # v2.8.2

.github/workflows/docker-build.yml

@@ -173,7 +173,7 @@ jobs:
     if: |
       (github.event_name != 'workflow_dispatch' || inputs.build-golden-image) &&
       needs.golden-image-tag.outputs.cache_hit != 'true'
-    uses: zama-ai/ci-templates/.github/workflows/common-docker.yml@478ee7de5baeab4fd49edfc42c9b81a56f6cfb03 # v1.0.5
+    uses: zama-ai/ci-templates/.github/workflows/common-docker.yml@f3b6046d0ce6f2eab83353e0fb788bd781be9f2e # v1.0.6
     permissions:
       actions: read # Required to read workflow run information
       contents: read # Required to checkout repository code
@@ -269,7 +269,7 @@ jobs:
       !cancelled() &&
       needs.golden-image-latest.result == 'success' &&
       (github.event_name != 'workflow_dispatch' || inputs.build-core-client)
-    uses: zama-ai/ci-templates/.github/workflows/common-docker.yml@478ee7de5baeab4fd49edfc42c9b81a56f6cfb03 # v1.0.5
+    uses: zama-ai/ci-templates/.github/workflows/common-docker.yml@f3b6046d0ce6f2eab83353e0fb788bd781be9f2e # v1.0.6
     permissions:
       actions: read # Required to read workflow run information
       contents: read # Required to checkout repository code
@@ -306,7 +306,7 @@ jobs:
       !cancelled() &&
       needs.golden-image-latest.result == 'success' &&
       (github.event_name != 'workflow_dispatch' || inputs.build-core-service)
-    uses: zama-ai/ci-templates/.github/workflows/common-docker.yml@478ee7de5baeab4fd49edfc42c9b81a56f6cfb03 # v1.0.5
+    uses: zama-ai/ci-templates/.github/workflows/common-docker.yml@f3b6046d0ce6f2eab83353e0fb788bd781be9f2e # v1.0.6
     permissions:
       actions: read # Required to read workflow run information
       contents: read # Required to checkout repository code

.github/workflows/kind-testing.yml

@@ -217,8 +217,6 @@ jobs:
         uses: ./.github/actions/setup-rust-and-protoc
         with:
           setup-rust: "false"
-          protoc-version: '26.1'
-          protoc-repo-token: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Setup cargo nextest
         if: matrix.cargo-check == false

.github/workflows/main.yml

@@ -408,8 +408,6 @@ jobs:
           rust-toolchain: ${{ env.RUST_IMAGE_VERSION }}
           rust-components: llvm-tools-preview, llvm-tools
           rust-cache: "false"
-          protoc-version: '26.1'
-          protoc-repo-token: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Setup Rust cache
         uses: Swatinem/rust-cache@779680da715d629ac1d338a641029a2f4372abb5 # v2.8.2  # zizmor: ignore[cache-poisoning]

.github/workflows/npm-release.yml

@@ -31,8 +31,6 @@ jobs:
         uses: ./.github/actions/setup-rust-and-protoc
         with:
           setup-rust: "false"
-          protoc-version: '26.1'
-          protoc-repo-token: ${{ secrets.GITHUB_TOKEN }}
 
       # WASM handling
       - name: Install

.github/workflows/pr-preview-deploy.yml

@@ -183,8 +183,6 @@ jobs:
           rust-toolchain: ${{ env.RUST_IMAGE_VERSION }}
           rust-components: rustfmt, clippy, llvm-tools-preview, llvm-tools
           rust-cache: "false"
-          protoc-version: '26.1'
-          protoc-repo-token: ${{ secrets.GITHUB_TOKEN }}
 
       # ======================================================================
       # KUBERNETES & HELM SETUP

.github/workflows/rust-lint.yml

@@ -38,8 +38,6 @@ jobs:
           rust-toolchain: ${{ env.RUST_IMAGE_VERSION }}
           rust-components: rustfmt, clippy
           rust-cache: "false"
-          protoc-version: '26.1'
-          protoc-repo-token: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Setup Rust cache
         uses: Swatinem/rust-cache@779680da715d629ac1d338a641029a2f4372abb5 # v2.8.2

.github/workflows/wasm-testing.yml

@@ -52,8 +52,6 @@ jobs:
         uses: ./.github/actions/setup-rust-and-protoc
         with:
           rust-toolchain: ${{ env.RUST_IMAGE_VERSION }}
-          protoc-version: '26.1'
-          protoc-repo-token: ${{ secrets.GITHUB_TOKEN }}
 
       # WASM handling
       - name: Install

.github/zizmor.yml

@@ -1,4 +1,7 @@
 rules:
+  github-env:
+    ignore:
+      - actions/setup-rust-and-protoc/action.yml:50
   use-trusted-publishing:
     ignore:
       # ignore line 61 in workflow-pr-dockerfile.yml, any column