ci: crowdin pull translations GH token fix
What the developer wrote
Authored by obrusvit
ci: crowdin pull translations GH token fix
- also adding myself as assignee and reviewer
[no changelog]
What changed, and why it matters
This commit changes an automated GitHub workflow so that translation-sync pull requests are created using a dedicated bot account's token instead of the repository's default GitHub token. It also adds one employee as the assignee and reviewer. The change is a CI hardening/fix, not a vulnerability in the Trezor firmware itself. There is no direct evidence in the commit that this fixes an active security issue, but using a scoped bot token is generally safer than the default token because it limits what the workflow can do.
Treat as a routine CI hardening change. Review that the GitHub App (TREZOR_BOT_APP_ID) has only the minimum required permissions (contents:write and pull-requests:write for this workflow) and that the private key secret is stored securely. No urgent action is needed for device firmware users.
Security signals we found
CI workflow token changed from default GITHUB_TOKEN to a dedicated GitHub App token
Commit title describes the change as a 'GH token fix'
No changes to firmware, crypto, or device code
Workflow remains limited to creating translation pull requests
Evidence from the diff
The diff modifies .github/workflows/crowdin-pull.yml. It replaces the built-in secrets.GITHUB_TOKEN used by peter-evans/create-pull-request with a token generated from a GitHub App (actions/create-github-app-token) using secrets.TREZOR_BOT_APP_ID and secrets.TREZOR_BOT_PRIVATE_KEY. It also sets assignees and reviewers to obrusvit. The commit title calls this a ‘GH token fix’. The change reduces the privileges tied to the default GITHUB_TOKEN and ties PR creation to a dedicated app identity, which is a common CI security improvement. No firmware code, device logic, or cryptographic handling is changed.
Changed components
.github/workflows/crowdin-pull.ymlInspect captured patch +10 / −1
diff --git a/.github/workflows/crowdin-pull.yml b/.github/workflows/crowdin-pull.yml
index 2df864d81..431537abb 100644
--- a/.github/workflows/crowdin-pull.yml
+++ b/.github/workflows/crowdin-pull.yml
@@ -46,13 +46,22 @@ jobs:
- name: Regenerate translation signatures
run: nix-shell --run "uv run make -C core translations"
+ - name: Generate GitHub App token
+ id: trezor-bot-token
+ uses: actions/create-github-app-token@v1
+ with:
+ app-id: ${{ secrets.TREZOR_BOT_APP_ID }}
+ private-key: ${{ secrets.TREZOR_BOT_PRIVATE_KEY }}
+
- name: Create PR
uses: peter-evans/create-pull-request@v6
with:
- token: ${{ secrets.GITHUB_TOKEN }}
+ token: ${{ steps.trezor-bot-token.outputs.token }}
commit-message: "chore(translations): sync Crowdin translations"
title: "Crowdin translations update"
body: "Automated update of translations pulled from Crowdin."
branch: ci/crowdin-sync-${{ github.ref_name }}-${{ github.run_id }}
base: ${{ github.ref_name }}
labels: translations
+ assignees: obrusvit
+ reviewers: obrusvit
Why this scored 21/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.