Paul Rastoin
d5c7b735d2
# Introduction Getting rid of the fine grained PAT used to dispatch to internal repositories. Repo dispatch requires the contents write permissions which is too wide for such use Refactored all senders and target to pass through a workflow dispatch instead Creating a centralize app that forges a token with actions: write only provided permissions to mitigate any token exfiltrations
122 lines
4.7 KiB
YAML
122 lines
4.7 KiB
YAML
name: 'Push website translations to Crowdin'
|
|
|
|
permissions:
|
|
contents: write
|
|
pull-requests: write
|
|
|
|
on:
|
|
workflow_dispatch:
|
|
workflow_call:
|
|
push:
|
|
branches: ['main']
|
|
paths:
|
|
- 'packages/twenty-website/**'
|
|
- '.github/crowdin-website.yml'
|
|
- '.github/workflows/website-i18n-push.yaml'
|
|
|
|
concurrency:
|
|
group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
|
|
cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}
|
|
|
|
jobs:
|
|
extract_website_translations:
|
|
name: Extract and upload website translations
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
|
|
with:
|
|
token: ${{ github.token }}
|
|
ref: main
|
|
|
|
- name: Setup website i18n branch
|
|
run: |
|
|
git fetch origin i18n-website || true
|
|
git checkout -B i18n-website origin/i18n-website || git checkout -b i18n-website
|
|
|
|
- name: Install dependencies
|
|
uses: ./.github/actions/yarn-install
|
|
|
|
- name: Build dependencies
|
|
run: npx nx build twenty-shared
|
|
|
|
- name: Extract website translations
|
|
run: npx nx run twenty-website:lingui:extract
|
|
|
|
- name: Check and commit extracted files
|
|
id: check_extract_changes
|
|
run: |
|
|
git config --global user.name 'github-actions'
|
|
git config --global user.email 'github-actions@twenty.com'
|
|
git add packages/twenty-website/src/locales
|
|
if ! git diff --staged --quiet --exit-code; then
|
|
git commit -m "chore: extract website translations"
|
|
echo "changes_detected=true" >> $GITHUB_OUTPUT
|
|
else
|
|
echo "changes_detected=false" >> $GITHUB_OUTPUT
|
|
fi
|
|
|
|
- name: Compile website translations
|
|
run: npx nx run twenty-website:lingui:compile
|
|
|
|
- name: Check and commit compiled files
|
|
id: check_compile_changes
|
|
run: |
|
|
git config --global user.name 'github-actions'
|
|
git config --global user.email 'github-actions@twenty.com'
|
|
git add packages/twenty-website/src/locales/generated
|
|
if ! git diff --staged --quiet --exit-code; then
|
|
git commit -m "chore: compile website translations"
|
|
echo "changes_detected=true" >> $GITHUB_OUTPUT
|
|
else
|
|
echo "changes_detected=false" >> $GITHUB_OUTPUT
|
|
fi
|
|
|
|
- name: Push changes and create remote branch if needed
|
|
if: steps.check_extract_changes.outputs.changes_detected == 'true' || steps.check_compile_changes.outputs.changes_detected == 'true'
|
|
run: git push origin HEAD:i18n-website
|
|
|
|
- name: Upload missing website translations
|
|
if: steps.check_extract_changes.outputs.changes_detected == 'true'
|
|
uses: crowdin/github-action@8868a33591d21088edfc398968173a3b98d51706 # v2
|
|
with:
|
|
upload_sources: true
|
|
upload_translations: true
|
|
download_translations: false
|
|
localization_branch_name: i18n-website
|
|
base_url: 'https://twenty.api.crowdin.com'
|
|
config: '.github/crowdin-website.yml'
|
|
env:
|
|
# Website translations project
|
|
CROWDIN_PROJECT_ID: '4'
|
|
CROWDIN_PERSONAL_TOKEN: ${{ secrets.CROWDIN_PERSONAL_TOKEN }}
|
|
|
|
- name: Create a pull request
|
|
if: steps.check_extract_changes.outputs.changes_detected == 'true' || steps.check_compile_changes.outputs.changes_detected == 'true'
|
|
run: |
|
|
if git diff --name-only origin/main..HEAD | grep -q .; then
|
|
gh pr create -B main -H i18n-website --title 'i18n - website translations' --body 'Created by Github action' || true
|
|
else
|
|
echo "No file differences between branches, skipping PR creation"
|
|
fi
|
|
env:
|
|
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
|
|
|
- name: Mint twenty-infra dispatch token
|
|
id: app-token
|
|
if: steps.check_extract_changes.outputs.changes_detected == 'true' || steps.check_compile_changes.outputs.changes_detected == 'true'
|
|
uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
|
|
with:
|
|
client-id: ${{ vars.TWENTY_WORKFLOW_DISPATCHER_CLIENT_ID }}
|
|
private-key: ${{ secrets.TWENTY_WORKFLOW_DISPATCHER_PRIVATE_KEY }}
|
|
owner: twentyhq
|
|
repositories: twenty-infra
|
|
permission-actions: write
|
|
|
|
- name: Trigger i18n automerge
|
|
if: steps.check_extract_changes.outputs.changes_detected == 'true' || steps.check_compile_changes.outputs.changes_detected == 'true'
|
|
env:
|
|
GH_TOKEN: ${{ steps.app-token.outputs.token }}
|
|
run: |
|
|
gh workflow run automerge-i18n.yaml --repo twentyhq/twenty-infra --ref main
|