From 71657b2d0bb3a6381decc5725b2296e6e92b19ed Mon Sep 17 00:00:00 2001
From: PJ <ipriyanshujain@gmail.com>
Date: Thu, 13 Aug 2026 20:48:14 +0530
Subject: [PATCH] ci: authenticate and pin the buf setup step

the anonymous release download hit the shared runner ip rate limit and
failed the job with 'socket hang up' after three retries.
---
 .github/workflows/ci.yml | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 9373c61..8268669 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -53,8 +53,16 @@ jobs:
           restore-keys: |
             bun-${{ runner.os }}-
 
+      # The token is what stops this step flaking: without it the action pulls
+      # buf's release tarball from github.com anonymously, on the shared runner
+      # IP's rate limit, and a throttled connection shows up as `socket hang
+      # up` after three retries. The version is the action's own default, made
+      # explicit so a new action release cannot move the buf we build with.
       - name: Install buf
         uses: bufbuild/buf-setup-action@v1
+        with:
+          version: "1.50.0"
+          github_token: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Install protoc plugins
         run: |