feat: access control contract #744

	# Copied from https://buf.build/docs/ci-cd/github-actions/
	#
	# With the default configuration above, the Action does the following:
	# - On a pull request, it runs all checks (buf build, buf lint, buf format, and buf breaking) and posts a summary comment on the PR.
	# - When you push a Git commit, tag, or branch to GitHub, it pushes named modules to the BSR using buf push.
	# - When you delete a Git branch or tag, it archives the corresponding label on the BSR.
	#
	# This workflow could be merged with compile-protobufs.yaml, but we keep them separate for now,
	# given that this workflow requires PR write permissions.
	# If buf works well I think we should eventually migrate all manual protoc stuff to using buf.
	# This would give us versioned golang bindings, as well as better documentation, and a bunch of other stuff.
	name: Buf Proto
	on:
	push:
	branches:
	- master
	pull_request:
	merge_group:

	permissions:
	contents: read
	pull-requests: write

	jobs:
	buf:
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 #4.2.2
	- uses: bufbuild/buf-action@v1
	with:
	token: ${{ secrets.BUF_TOKEN }}
	# Change setup_only to true if you only want to set up the Action and not execute other commands.
	# Otherwise, you can delete this line--the default is false.
	setup_only: false
	# Optional GitHub token for API requests. Ensures requests aren't rate limited.
	github_token: ${{ secrets.GITHUB_TOKEN }}
	input: ./api

Provide feedback