ci: crowdin pull translations and make a PR
What the developer wrote
Authored by obrusvit
ci: crowdin pull translations and make a PR
- Github Actions workflow to pull translation files from Crowdin, merge
them into lang jsons
- manually triggered
[no changelog]
What changed, and why it matters
This commit adds a manually-triggered GitHub Actions workflow that downloads translated text files from the Crowdin service, merges them into the project's language files, and opens a pull request. It does not change any firmware code, wallet logic, or cryptographic handling. There is no indication this introduces a security vulnerability.
No security action required. As a routine hardening measure, ensure the `CROWDIN_TOKEN` and `CROWDIN_PROJECT_ID` secrets are stored as repository/org secrets with minimal access, and review generated translation PRs before merge.
Security signals we found
No strong security signals were identified.
Evidence from the diff
The new workflow .github/workflows/crowdin-pull.yml runs only on workflow_dispatch from the main branch. It checks out the repository, splits en.json into layout-specific files, downloads translations via the official crowdin/github-action@v2, merges them, regenerates translation signatures, and creates a PR using peter-evans/create-pull-request@v6. Permissions are scoped to contents: write and pull-requests: write, which are necessary for creating a branch/PR. No secrets are exposed in logs, no third-party code is executed beyond pinned actions, and no user input is interpolated into shell commands.
Changed components
.github/workflows/crowdin-pull.ymlInspect captured patch +58 / −0
diff --git a/.github/workflows/crowdin-pull.yml b/.github/workflows/crowdin-pull.yml
new file mode 100644
index 000000000..d8a3c9707
--- /dev/null
+++ b/.github/workflows/crowdin-pull.yml
@@ -0,0 +1,58 @@
+name: Crowdin - pull translations (manual)
+
+on:
+ workflow_dispatch:
+
+permissions:
+ contents: write
+ pull-requests: write
+
+concurrency:
+ group: crowdin-pull
+ cancel-in-progress: true
+
+jobs:
+ crowdin-pull-and-pr:
+ if: github.ref_name == 'main' # run only when dispatched from main
+ runs-on: ubuntu-latest
+ steps:
+ - name: Checkout
+ uses: actions/checkout@v4
+ with:
+ submodules: recursive
+
+ - name: Setup environment
+ uses: ./.github/actions/environment
+
+ - name: Split source files (en.json -> en_<layout>.json)
+ run: nix-shell --run "uv run python core/translations/crowdin.py split"
+
+ - name: Download translations from Crowdin
+ uses: crowdin/github-action@v2
+ with:
+ config: core/translations/crowdin.yml
+ upload_sources: false
+ download_translations: true
+ push_sources: false
+ push_translations: false
+ create_pull_request: false
+ env:
+ CROWDIN_PERSONAL_TOKEN: ${{ secrets.CROWDIN_TOKEN }}
+ CROWDIN_PROJECT_ID: ${{ secrets.CROWDIN_PROJECT_ID }}
+
+ - name: Merge translations
+ run: nix-shell --run "uv run python core/translations/crowdin.py merge"
+
+ - name: Regenerate translation signatures
+ run: nix-shell --run "make -C core translations"
+
+ - name: Create PR
+ uses: peter-evans/create-pull-request@v6
+ with:
+ token: ${{ secrets.GITHUB_TOKEN }}
+ commit-message: "chore(translations): sync Crowdin translations"
+ title: "Crowdin translations update"
+ body: "Automated update of translations pulled from Crowdin."
+ branch: ci/crowdin-sync-${{ github.ref_name }}-${{ github.run_id }}
+ base: ${{ github.ref_name }}
+ labels: translations
Why this scored 15/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.