Harden latest-conformance CI test

.github/workflows/latest_conformance.yml

@@ -36,10 +36,21 @@ jobs:
         # Dependencies from https://github.com/protocolbuffers/protobuf/blob/main/src/README.md
         run: sudo apt-get update && sudo apt-get install -y git cmake curl make g++ jq
 
-      - name: Get SHA of Protobuf repo's main branch
+      - name: Get a stable SHA from Protobuf repo's main branch
         id: get-protobuf-sha
         run: |
-          echo sha="$( curl -u "u:${{github.token}}" https://api.github.com/repos/protocolbuffers/protobuf/git/ref/heads/main | jq .object.sha | tr -d '"' )" >> $GITHUB_OUTPUT
+          # Protobuf can commit source changes before its generated files. Use a
+          # one-day delay so both commits are available before we build main.
+          cutoff="$(date --utc --date="24 hours ago" +"%Y-%m-%dT%H:%M:%SZ")"
+          sha="$(
+            curl --fail --silent --show-error \
+              --header "Authorization: Bearer ${{ github.token }}" \
+              --header "X-GitHub-Api-Version: 2022-11-28" \
+              "https://api.github.com/repos/protocolbuffers/protobuf/commits?sha=main&until=${cutoff}&per_page=1" |
+              jq --raw-output '.[0].sha'
+          )"
+          test -n "${sha}" && test "${sha}" != "null"
+          echo "sha=${sha}" >> "$GITHUB_OUTPUT"
 
       - name: Checkout Protobuf repo
         uses: actions/checkout@v2