What the developer wrote
Authored by obrusvit
ci: fix crowdin push split command
[no changelog]
What changed, and why it matters
This is a routine fix to a GitHub Actions workflow that pushes translation source files to Crowdin. It renames the job, adjusts how the environment is set up, and corrects the secret name used for the Crowdin API token. There is no security-relevant change.
No security action required. Review as normal CI maintenance if desired.
Security signals we found
No strong security signals were identified.
Evidence from the diff
The commit modifies .github/workflows/crowdin-push.yml. Changes include: renaming the job from ‘push’ to ‘crowdin-push-sources’; switching the branch check from github.ref to github.ref_name; replacing a manual checkout of ‘main’ with a recursive submodule checkout; replacing actions/setup-python with a local ./.github/actions/environment action; running the split script via nix-shell/uv instead of a direct Python invocation; and changing the secret name from CROWDIN_PERSONAL_TOKEN to CROWDIN_TOKEN. These are CI/maintenance changes with no apparent security implications.
Changed components
.github/workflows/crowdin-push.ymlInspect captured patch +8 / −11
diff --git a/.github/workflows/crowdin-push.yml b/.github/workflows/crowdin-push.yml
index 3d755ae70..fc59c97da 100644
--- a/.github/workflows/crowdin-push.yml
+++ b/.github/workflows/crowdin-push.yml
@@ -11,25 +11,22 @@ concurrency:
cancel-in-progress: false
jobs:
- push:
+ crowdin-push-sources:
name: Split and upload sources
- if: github.ref == 'refs/heads/main'
+ if: github.ref_name == 'main' # run only when dispatched from main
runs-on: ubuntu-latest
environment: crowdin
steps:
- - name: Checkout main
+ - name: Checkout
uses: actions/checkout@v4
with:
- ref: main
+ submodules: recursive
- - name: Set up Python
- uses: actions/setup-python@v5
- with:
- python-version: '3.11'
+ - name: Setup environment
+ uses: ./.github/actions/environment
- name: Split en.json into per-layout files
- working-directory: core/translations
- run: python crowdin.py split
+ run: nix-shell --run "uv run python core/translations/crowdin.py split"
- name: Upload sources to Crowdin
uses: crowdin/github-action@v2
@@ -37,5 +34,5 @@ jobs:
upload_sources: true
config: core/translations/crowdin.yml
env:
- CROWDIN_PERSONAL_TOKEN: ${{ secrets.CROWDIN_PERSONAL_TOKEN }}
+ CROWDIN_PERSONAL_TOKEN: ${{ secrets.CROWDIN_TOKEN }}
CROWDIN_PROJECT_ID: ${{ secrets.CROWDIN_PROJECT_ID }}
Why this scored 15/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.