From 536af8ccce3847bcdfd98c02c0905ffccfd28473 Mon Sep 17 00:00:00 2001
From: Jon Skeet <jonskeet@google.com>
Date: Tue, 5 May 2026 12:05:42 +0000
Subject: [PATCH 1/2] chore: add a post-submit check that regenerating doesn't
 change anything

This is a post-submit as it takes a while (~25 minutes). We could
*potentially* make it a pre-submit and only generate packages which
have changed, but that would be more fiddly.

It would be nice not to specify the protoc or pandoc version here, but
that will require improvements in librarian (tracked in
https://github.com/googleapis/librarian/issues/5818).

Fixes https://github.com/googleapis/librarian/issues/4800
---
 .github/workflows/regenerate-all.yml | 69 ++++++++++++++++++++++++++++
 1 file changed, 69 insertions(+)
 create mode 100644 .github/workflows/regenerate-all.yml

diff --git a/.github/workflows/regenerate-all.yml b/.github/workflows/regenerate-all.yml
new file mode 100644
index 000000000000..0811b35985da
--- /dev/null
+++ b/.github/workflows/regenerate-all.yml
@@ -0,0 +1,69 @@
+name: Regenerate all packages after merging to main
+
+on:
+  push:
+    branches:
+      - main
+
+jobs:
+  regenerate:
+    runs-on: ubuntu-latest
+    env:
+      PANDOC_VERSION: 3.8.2
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+
+      - name: Install Go
+        uses: actions/setup-go@v6
+        with:
+          go-version: '1.26.x'
+
+      - name: Install protoc
+        uses: arduino/setup-protoc@v3
+        with:
+          version: "25.3"
+
+      - name: Install pandoc
+        run: |
+          mkdir /tmp/pandoc
+          curl -fsSL --retry 5 --retry-delay 15 -o /tmp/pandoc.tar.gz \
+            https://github.com/jgm/pandoc/releases/download/${PANDOC_VERSION}/pandoc-${PANDOC_VERSION}-linux-amd64.tar.gz
+          tar -xvf /tmp/pandoc.tar.gz -C /tmp/pandoc --strip-components=1
+
+      - name: Install Python packages for Librarian
+        run: |
+          version=$(sed -n 's/^version: *//p' librarian.yaml)
+          go run "github.com/googleapis/librarian/cmd/librarian@${version}" install
+
+      - name: Regenerate
+        run: |
+          version=$(sed -n 's/^version: *//p' librarian.yaml)
+          PATH=$PATH:/tmp/pandoc/bin
+          go run "github.com/googleapis/librarian/cmd/librarian@${version}" generate -all -v
+
+      - name: Create issue on diff
+        if: failure()
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          if [ -n "$(git status --porcelain)" ]; then
+            TITLE="Regeneration check found diff"
+            RUN_URL="${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}"
+            DIFF_STAT=$(git diff --stat)
+            BODY="The post-submit [regeneration check]($RUN_URL) found a diff.
+
+            Diff summary:
+            \`\`\`
+            $DIFF_STAT
+            \`\`\`"
+
+            EXISTING_ISSUE=$(gh issue list --state open --search "in:title \"$TITLE\"" --json number --jq '.[0].number')
+            if [ -z "$EXISTING_ISSUE" ]; then
+              gh issue create --title "$TITLE" --body "$BODY"
+            else
+              echo "Issue #$EXISTING_ISSUE already exists, adding a comment."
+              gh issue comment "$EXISTING_ISSUE" --body "Another failure with diff occurred: $RUN_URL"
+            fi
+          fi
\ No newline at end of file

From 34ec55c48a8a77e497377d4ce5e8f3d5aed80ffe Mon Sep 17 00:00:00 2001
From: Jon Skeet <jonskeet@google.com>
Date: Wed, 6 May 2026 15:07:23 +0000
Subject: [PATCH 2/2] chore: add permissions

---
 .github/workflows/regenerate-all.yml | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/.github/workflows/regenerate-all.yml b/.github/workflows/regenerate-all.yml
index 0811b35985da..f47592a82d88 100644
--- a/.github/workflows/regenerate-all.yml
+++ b/.github/workflows/regenerate-all.yml
@@ -5,6 +5,10 @@ on:
     branches:
       - main
 
+permissions:
+  contents: read
+  issues: write
+
 jobs:
   regenerate:
     runs-on: ubuntu-latest