chore(ci): updates to pull/push crowdin workflows [no changelog]
What the developer wrote
Authored by Michal Kazda
chore(ci): updates to pull/push crowdin workflows
[no changelog]
What changed, and why it matters
This commit updates two GitHub Actions workflow files that manage translation files with Crowdin. It bumps the versions of some reusable actions (checkout, create GitHub app token, create pull request), adds input fields so the workflow caller can choose who is assigned and who reviews the resulting pull request, and reorders a couple of lines. There is no change to the Trezor firmware code that runs on the device, no change to cryptographic handling, and no indication of a security fix or vulnerability.
No security action required. Treat as routine CI maintenance.
Security signals we found
No strong security signals were identified.
Evidence from the diff
The diff is limited to .github/workflows/crowdin-pull.yml and .github/workflows/crowdin-push.yml. Changes: (1) crowdin-pull.yml adds workflow_dispatch inputs for assignee and reviewer with default ‘Thalarion’, replacing hard-coded ‘obrusvit’; (2) action versions updated: actions/checkout@v4 -> @v6, actions/create-github-app-token@v1 -> @v2, peter-evans/create-pull-request@v6 -> @v8; (3) minor wording and ordering changes. No secrets, permissions, or job logic beyond PR metadata were altered. No device firmware or crypto code is touched.
Changed components
.github/workflows/crowdin-pull.yml.github/workflows/crowdin-push.ymlInspect captured patch +19 / −8
diff --git a/.github/workflows/crowdin-pull.yml b/.github/workflows/crowdin-pull.yml
index 431537ab..3e72afb6 100644
--- a/.github/workflows/crowdin-pull.yml
+++ b/.github/workflows/crowdin-pull.yml
@@ -2,6 +2,17 @@ name: Crowdin - pull translations (manual)
on:
workflow_dispatch:
+ inputs:
+ assignee:
+ type: string
+ description: 'GitHub username of the Assignee for the pull request'
+ required: true
+ default: 'Thalarion'
+ reviewer:
+ type: string
+ description: 'GitHub username of the Reviewer for the pull request'
+ required: true
+ default: 'Thalarion'
permissions:
contents: write
@@ -17,14 +28,14 @@ jobs:
runs-on: ubuntu-latest
steps:
- name: Checkout
- uses: actions/checkout@v4
+ uses: actions/checkout@v6
with:
submodules: recursive
- name: Setup environment
uses: ./.github/actions/environment
- - name: Split source files (en.json -> en_<layout>.json)
+ - name: Split en.json into per-layout files
run: nix-shell --run "uv run python core/translations/crowdin.py split"
- name: Download translations from Crowdin
@@ -48,13 +59,13 @@ jobs:
- name: Generate GitHub App token
id: trezor-bot-token
- uses: actions/create-github-app-token@v1
+ uses: actions/create-github-app-token@v2
with:
app-id: ${{ secrets.TREZOR_BOT_APP_ID }}
private-key: ${{ secrets.TREZOR_BOT_PRIVATE_KEY }}
- name: Create PR
- uses: peter-evans/create-pull-request@v6
+ uses: peter-evans/create-pull-request@v8
with:
token: ${{ steps.trezor-bot-token.outputs.token }}
commit-message: "chore(translations): sync Crowdin translations"
@@ -63,5 +74,5 @@ jobs:
branch: ci/crowdin-sync-${{ github.ref_name }}-${{ github.run_id }}
base: ${{ github.ref_name }}
labels: translations
- assignees: obrusvit
- reviewers: obrusvit
+ assignees: ${{ github.event.inputs.assignee }}
+ reviewers: ${{ github.event.inputs.reviewer }}
diff --git a/.github/workflows/crowdin-push.yml b/.github/workflows/crowdin-push.yml
index fc59c97d..b41bf842 100644
--- a/.github/workflows/crowdin-push.yml
+++ b/.github/workflows/crowdin-push.yml
@@ -18,7 +18,7 @@ jobs:
environment: crowdin
steps:
- name: Checkout
- uses: actions/checkout@v4
+ uses: actions/checkout@v6
with:
submodules: recursive
@@ -31,8 +31,8 @@ jobs:
- name: Upload sources to Crowdin
uses: crowdin/github-action@v2
with:
- upload_sources: true
config: core/translations/crowdin.yml
+ upload_sources: true
env:
CROWDIN_PERSONAL_TOKEN: ${{ secrets.CROWDIN_TOKEN }}
CROWDIN_PROJECT_ID: ${{ secrets.CROWDIN_PROJECT_ID }}
Why this scored 15/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.