d5c7b735d2
# Introduction Getting rid of the fine grained PAT used to dispatch to internal repositories. Repo dispatch requires the contents write permissions which is too wide for such use Refactored all senders and target to pass through a workflow dispatch instead Creating a centralize app that forges a token with actions: write only provided permissions to mitigate any token exfiltrations
123 lines
4.5 KiB
YAML
123 lines
4.5 KiB
YAML
name: 'Push translations to Crowdin'
|
|
|
|
permissions:
|
|
contents: write
|
|
pull-requests: write
|
|
|
|
on:
|
|
workflow_dispatch:
|
|
workflow_call:
|
|
push:
|
|
branches: ['main']
|
|
|
|
concurrency:
|
|
group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
|
|
cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}
|
|
|
|
jobs:
|
|
extract_translations:
|
|
name: Extract and upload translations
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
|
|
with:
|
|
token: ${{ github.token }}
|
|
ref: main
|
|
|
|
- name: Setup i18n branch
|
|
run: |
|
|
git fetch origin i18n || true
|
|
git checkout -B i18n origin/i18n || git checkout -b i18n
|
|
|
|
- name: Install dependencies
|
|
uses: ./.github/actions/yarn-install
|
|
|
|
- name: Build dependencies
|
|
run: npx nx build twenty-shared
|
|
|
|
- name: Extract translations
|
|
run: |
|
|
npx nx run twenty-server:lingui:extract
|
|
npx nx run twenty-emails:lingui:extract
|
|
npx nx run twenty-front:lingui:extract
|
|
|
|
- name: Check and commit extracted files
|
|
id: check_extract_changes
|
|
run: |
|
|
git config --global user.name 'github-actions'
|
|
git config --global user.email 'github-actions@twenty.com'
|
|
git add .
|
|
if ! git diff --staged --quiet --exit-code; then
|
|
git commit -m "chore: extract translations"
|
|
echo "changes_detected=true" >> $GITHUB_OUTPUT
|
|
else
|
|
echo "changes_detected=false" >> $GITHUB_OUTPUT
|
|
fi
|
|
|
|
- name: Compile translations
|
|
run: |
|
|
npx nx run twenty-server:lingui:compile
|
|
npx nx run twenty-emails:lingui:compile
|
|
npx nx run twenty-front:lingui:compile
|
|
|
|
- name: Check and commit compiled files
|
|
id: check_compile_changes
|
|
run: |
|
|
git config --global user.name 'github-actions'
|
|
git config --global user.email 'github-actions@twenty.com'
|
|
git add .
|
|
if ! git diff --staged --quiet --exit-code; then
|
|
git commit -m "chore: compile translations"
|
|
echo "changes_detected=true" >> $GITHUB_OUTPUT
|
|
else
|
|
echo "changes_detected=false" >> $GITHUB_OUTPUT
|
|
fi
|
|
|
|
- name: Push changes and create remote branch if needed
|
|
if: steps.check_extract_changes.outputs.changes_detected == 'true' || steps.check_compile_changes.outputs.changes_detected == 'true'
|
|
run: git push origin HEAD:i18n
|
|
|
|
- name: Upload missing translations
|
|
if: steps.check_extract_changes.outputs.changes_detected == 'true'
|
|
uses: crowdin/github-action@8868a33591d21088edfc398968173a3b98d51706 # v2
|
|
with:
|
|
upload_sources: true
|
|
upload_translations: true
|
|
download_translations: false
|
|
localization_branch_name: i18n
|
|
base_url: 'https://twenty.api.crowdin.com'
|
|
config: '.github/crowdin-app.yml'
|
|
env:
|
|
# App translations project
|
|
CROWDIN_PROJECT_ID: '1'
|
|
CROWDIN_PERSONAL_TOKEN: ${{ secrets.CROWDIN_PERSONAL_TOKEN }}
|
|
- name: Create a pull request
|
|
if: steps.check_extract_changes.outputs.changes_detected == 'true' || steps.check_compile_changes.outputs.changes_detected == 'true'
|
|
run: |
|
|
if git diff --name-only origin/main..HEAD | grep -q .; then
|
|
gh pr create -B main -H i18n --title 'i18n - translations' --body 'Created by Github action' || true
|
|
else
|
|
echo "No file differences between branches, skipping PR creation"
|
|
fi
|
|
env:
|
|
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
|
|
|
- name: Mint twenty-infra dispatch token
|
|
id: app-token
|
|
if: steps.check_extract_changes.outputs.changes_detected == 'true' || steps.check_compile_changes.outputs.changes_detected == 'true'
|
|
uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
|
|
with:
|
|
client-id: ${{ vars.TWENTY_WORKFLOW_DISPATCHER_CLIENT_ID }}
|
|
private-key: ${{ secrets.TWENTY_WORKFLOW_DISPATCHER_PRIVATE_KEY }}
|
|
owner: twentyhq
|
|
repositories: twenty-infra
|
|
permission-actions: write
|
|
|
|
- name: Trigger i18n automerge
|
|
if: steps.check_extract_changes.outputs.changes_detected == 'true' || steps.check_compile_changes.outputs.changes_detected == 'true'
|
|
env:
|
|
GH_TOKEN: ${{ steps.app-token.outputs.token }}
|
|
run: |
|
|
gh workflow run automerge-i18n.yaml --repo twentyhq/twenty-infra --ref main
|