Update translations-sync.yml

Signed-off-by: Aviv Keller <me@aviv.sh>

Author: avivkeller

.github/workflows/translations-sync.yml

@@ -3,26 +3,26 @@
 
 # See translations-upload.yml for automation to upload our source content
 # See translations-pr-lint.yml for quality control we conduct on ingress of new translations.
-name: Crowdin Translations Sync
+name: Crowdin Download
 
 on:
-  workflow_dispatch: # Manual trigger for urgent fixes
+  workflow_dispatch: # Allow running when we want to, for events such as urgent translation mistakes or 100% completed languages
   schedule:
-    - cron: '0 5 * * 5' # Fridays at 05:00 UTC, allowing weekend review time
+    - cron: '0 5 * * 5' # At 05:00 on Fridays. This guarantees that we have the 72 hour weekend time to review translations.
 
 # Cancel any runs on the same branch
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
-permissions: {}
+permissions:
+  contents: read
 
 env:
-  COMMIT_MSG: 'chore: sync translations from crowdin'
-  HEAD_REF: chore/crowdin
+  BRANCH_NAME: chore/crowdin
 
 jobs:
-  sync-translations:
+  synchronize-with-crowdin:
     runs-on: ubuntu-latest
     steps:
       - name: Harden Runner
@@ -35,46 +35,46 @@ jobs:
         with:
           token: ${{ secrets.CROWDIN_GITHUB_BOT_TOKEN }}
 
-      # Downloads translations from Crowdin and creates a PR
-      # See all the options at https://github.com/crowdin/github-action
-      - name: Download Translations & Create PR
+        # see all the options at https://github.com/crowdin/github-action
+      - name: Crowdin PR
         uses: crowdin/github-action@b8012bd5491b8aa8578b73ab5b5f5e7c94aaa6e2 # v2.7.0
         with:
+          # do not upload anything - this is a one-way operation download
           upload_sources: false
           upload_translations: false
+          # the rest of this controls how the PR comes in with new translations
           download_translations: true
-          localization_branch_name: ${{ env.HEAD_REF }}
+          localization_branch_name: ${{ env.BRANCH_NAME }}
           create_pull_request: true
-          pull_request_title: '[automated]: Crowdin Translations Sync'
-          pull_request_body: 'New translations from the [Node.js Crowdin project](https://crowdin.com/project/nodejs-web)'
-          commit_message: ${{ env.COMMIT_MSG }}
+          pull_request_title: '[automated]: crowdin sync'
+          pull_request_body: 'New Crowdin translations from the [Node.js Crowdin project](https://crowdin.com/project/nodejs-web)'
+          commit_message: 'chore: synced translations from crowdin'
         env:
           GITHUB_TOKEN: ${{ secrets.CROWDIN_GITHUB_BOT_TOKEN }}
+          # A numeric ID, found at https://crowdin.com/project/nodejs-web/tools/api
           CROWDIN_PROJECT_ID: ${{ secrets.CROWDIN_PROJECT_ID }}
+          # Created from https://crowdin.com/settings#api-key logged in using nodejs-crowdin-bot
           CROWDIN_PERSONAL_TOKEN: ${{ secrets.CROWDIN_PERSONAL_TOKEN }}
 
-  format-translations:
-    needs: sync-translations
+  format_crowdin_pull_request:
+    needs: synchronize-with-crowdin
     runs-on: ubuntu-latest
+
+    permissions:
+      # This permission is required by `stefanzweifel/git-auto-commit-action`
+      contents: write
+
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0
+        uses: step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0 # v2.12.0
         with:
           egress-policy: audit
 
-      # Checks out the PR branch created by the previous job
-      - name: Checkout PR Branch
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+      - name: Git Checkout
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
-          ref: ${{ env.HEAD_REF }}
+          ref: ${{ env.BRANCH_NAME }}
           token: ${{ secrets.CROWDIN_GITHUB_BOT_TOKEN }}
-          fetch-depth: 0
-
-      # Setup git user for commits
-      - name: Setup Git User
-        run: |
-          git config --global user.name "nodejs-crowdin"
-          git config --global user.email "nodejs-crowdin@users.noreply.github.com"
 
       - name: Restore Lint Cache
         uses: actions/cache/restore@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
@@ -107,19 +107,24 @@ jobs:
       - name: Install packages
         run: pnpm install --frozen-lockfile
 
-      # Re-stage latest commit and run lint-staged
-      - name: Re-stage and Format Files
-        run: |
-          # Soft reset to unstage the commit but keep changes
-          git reset --soft HEAD^
+      - name: Run ESLint
+        working-directory: apps/site
+        run: pnpm lint:md --fix
 
-          # Run lint-staged on the staged files
-          # This will run linters/formatters only on changed files
-          # according to the configuration in package.json or .lintstagedrc
-          pnpm lint-staged
+      - name: Run Prettier
+        run: pnpm prettier:fix
 
-          git commit -m "$COMMIT_MSG" --signoff --no-verify
+      - name: Push Changes back to Pull Request
+        uses: stefanzweifel/git-auto-commit-action@b863ae1933cb653a53c021fe36dbb774e1fb9403 # v5.2.0
+        with:
+          commit_options: '--no-verify --signoff'
+          commit_message: 'chore: automated format of translated files'
+          branch: 'chore/crowdin'
 
-      # Push the changes back to the PR branch
-      - name: Push Changes
-        run: git push origin HEAD:$HEAD_REF --force
+      - name: Save Lint Cache
+        uses: actions/cache/save@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
+        with:
+          path: |
+            apps/site/.eslintmdcache
+            apps/site/.prettiercache
+          key: cache-lint-${{ hashFiles('pnpm-lock.yaml') }}-${{ hashFiles('apps/site/.eslintmdcache') }}