protobuf: update to 31.1

[aborrero]

Update package to 31.1

Related: #56871

Pre-review Checklist

For version bump PRs

• The epoch field is reset to 0

[octo-sts]

🔄 Build Failed: Git Checkout Error

fatal: Remote branch v3.31.1 not found in upstream origin

Build Details

Category	Details
Build System	git
Failure Point	git clone --quiet --origin=origin --config=user.name=Melange Build --config=user.email=melange-build@cgr.dev --config=advice.detachedHead=false --branch=v3.31.1 --depth=1 https://github.com/protocolbuffers/protobuf /tmp/tmp.EXqsdk

Root Cause Analysis 🔍

The build is attempting to clone the protobuf repository with v3.31.1 specified as a branch (using --branch=v3.31.1), but v3.31.1 is a tag, not a branch. The git checkout script in Melange is trying to use the tag as a branch name, causing the checkout to fail.

---

🔍 Build failure fix suggestions

Found similar build failures that have been fixed in the past and analyzed them to suggest a fix:

Similar PRs with fixes

• filebrowser/2.32.0-r4: cve remediation #49939

Suggested Changes

File: protobuf.yaml

• replace at line 46-49 (pipeline section)
  Original:

  - uses: git-checkout
    with:
      repository: https://github.com/protocolbuffers/protobuf
      tag: v${{package.version}}
      expected-commit: 74211c0dfc2777318ab53c2cd2c317a2ef9012de
      cherry-picks: |
        main/ced605d0e6a7ad20985375b596b2ca6720e07737: utf8_range: add version marker to library

Replacement:

  - uses: git-checkout
    with:
      repository: https://github.com/protocolbuffers/protobuf
      branch: main
      ref: v${{package.version}}
      expected-commit: 74211c0dfc2777318ab53c2cd2c317a2ef9012de
      cherry-picks: |
        main/ced605d0e6a7ad20985375b596b2ca6720e07737: utf8_range: add version marker to library

Click to expand fix analysis

Analysis

The error occurs because the build is trying to use the --branch flag when checking out a tag in the git repository. In the similar fixed issue (#49939), the root cause was identical - the build failed because it tried to check out a tag as if it were a branch. Looking at the fix, I can see they modified the git checkout method to correctly handle tags instead of treating them as branches. The current protobuf.yaml file is using the git-checkout action with a tag parameter, but the error message shows that it's still translating this to a --branch flag in the git command, which is incorrect for tag references.

Click to expand fix explanation

Explanation

The build is failing because the git-checkout action in Melange is translating the tag parameter to a --branch flag in the git command, which is incorrect for checking out tags. Git tags need to be checked out differently than branches.

The fix changes the checkout approach by:

1. Setting branch: main to initially clone the main branch
2. Using ref: v${{package.version}} to specify the tag reference to check out after cloning

This approach allows the system to first clone a valid branch (main) and then check out the specific tag reference. The git command will properly handle the tag reference rather than trying to find it as a branch. This matches the actual git workflow for checking out tags - first clone a branch, then check out the specific tag.

The error message clearly shows the command that's failing: git clone --quiet --origin=origin --config=user.name=Melange Build --config=user.email=melange-build@cgr.dev --config=advice.detachedHead=false --branch=v3.31.1 --depth=1 https://github.com/protocolbuffers/protobuf. Changing the parameters from tag to branch and ref will modify how the git command is constructed, avoiding the problematic --branch=v3.31.1 parameter.

Click to expand alternative approaches

Alternative Approaches

• Use a direct runs step with explicit git commands instead of the git-checkout action: This would give more control over the exact git commands used, but would require more maintenance and wouldn't follow the standard patterns used in other Wolfi packages.
• Use repository mirror settings in Melange to potentially avoid git checkout issues, though this would require additional configuration.
• Add a temporary workaround by using a shallow clone without specifying branch or tag, then manually check out the tag in a separate step, though this is less elegant than fixing the git-checkout action usage.

---

Was this comment helpful? Please use 👍 or 👎 reactions on this comment.

[dannf]

The change looks good in itself - thanks @aborrero! - but we'll need to plan/schedule an ABI transition, so ticking "Request changes" for now to add a blocking comment.

[aborrero]

upstream weird logic in the git tags / github release will require additional work on this PR. Not ready to be merged just yet.

[powersj]

Unassigning sustaining-team since this is blocked.

[github-actions]

This Pull Request is stale because it has been open for 90 days with
no activity. It will automatically close after 30 more days of
inactivity. Keep fresh with the 'lifecycle/frozen' label.

[AmberArcadia]

Already on 32.1 on main, this is now obsolete.