fix(crowdin): workflow improvements

Author: avivkeller

.github/workflows/translations-sync.yml

@@ -3,27 +3,29 @@
 
 # See translations-upload.yml for automation to upload our source content
 # See translations-pr-lint.yml for quality control we conduct on ingress of new translations.
-name: Crowdin Download
+name: Crowdin Translations Sync
 
 on:
-  workflow_dispatch: # Allow running when we want to, for events such as urgent translation mistakes or 100% completed languages
+  workflow_dispatch: # Manual trigger for urgent fixes
   schedule:
-    - cron: '0 5 * * 5' # At 05:00 on Fridays. This guarantees that we have the 72 hour weekend time to review translations.
+    - cron: '0 5 * * 5' # Fridays at 05:00 UTC, allowing weekend review time
 
 # Cancel any runs on the same branch
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
-permissions:
-  contents: read
+permissions: {}
+
+env:
+  COMMIT_MSG: 'chore: sync translations from crowdin'
+  HEAD_REF: chore/crowdin
 
 jobs:
-  synchronize-with-crowdin:
+  sync-translations:
     runs-on: ubuntu-latest
     outputs:
-      pull_request_number: ${{ steps.crowdin_pr.outputs.pull_request_number }}
-
+      pr_number: ${{ steps.crowdin_pr.outputs.pull_request_number }}
     steps:
       - name: Harden Runner
         uses: step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0 # v2.12.0
@@ -35,48 +37,41 @@ jobs:
         with:
           token: ${{ secrets.CROWDIN_GITHUB_BOT_TOKEN }}
 
-        # see all the options at https://github.com/crowdin/github-action
-      - name: Crowdin PR
-        uses: crowdin/github-action@b8012bd5491b8aa8578b73ab5b5f5e7c94aaa6e2 # v2.7.0
+      # Downloads translations from Crowdin and creates a PR
+      # See all the options at https://github.com/crowdin/github-action
+      - name: Download Translations & Create PR
         id: crowdin_pr
+        uses: crowdin/github-action@b8012bd5491b8aa8578b73ab5b5f5e7c94aaa6e2 # v2.7.0
         with:
-          # do not upload anything - this is a one-way operation download
           upload_sources: false
           upload_translations: false
-          # the rest of this controls how the PR comes in with new translations
           download_translations: true
-          localization_branch_name: chore/crowdin
+          localization_branch_name: ${{ env.HEAD_REF }}
           create_pull_request: true
-          pull_request_title: '[automated]: crowdin sync'
-          pull_request_body: 'New Crowdin translations from the [Node.js Crowdin project](https://crowdin.com/project/nodejs-web)'
-          commit_message: 'chore: synced translations from crowdin'
+          pull_request_title: '[automated]: Crowdin Translations Sync'
+          pull_request_body: 'New translations from the [Node.js Crowdin project](https://crowdin.com/project/nodejs-web)'
+          commit_message: ${{ env.COMMIT_MSG }}
         env:
           GITHUB_TOKEN: ${{ secrets.CROWDIN_GITHUB_BOT_TOKEN }}
-          # A numeric ID, found at https://crowdin.com/project/nodejs-web/tools/api
           CROWDIN_PROJECT_ID: ${{ secrets.CROWDIN_PROJECT_ID }}
-          # Created from https://crowdin.com/settings#api-key logged in using nodejs-crowdin-bot
           CROWDIN_PERSONAL_TOKEN: ${{ secrets.CROWDIN_PERSONAL_TOKEN }}
 
-  format_crowdin_pull_request:
-    needs: synchronize-with-crowdin
+  format-translations:
+    needs: sync-translations
     runs-on: ubuntu-latest
-
-    permissions:
-      # This permission is required by `stefanzweifel/git-auto-commit-action`
-      contents: write
-
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0 # v2.12.0
+        uses: step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0
         with:
           egress-policy: audit
 
-      - name: Git Checkout
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      # Checks out the PR branch created by the previous job
+      - name: Checkout PR Branch
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
         with:
-          # Use the number from the output of crowdin/github-action
-          ref: refs/pull/${{ needs.synchronize-with-crowdin.outputs.pull_request_number }}/head
+          ref: refs/pull/${{ needs.sync-translations.outputs.pr_number }}/head
           token: ${{ secrets.CROWDIN_GITHUB_BOT_TOKEN }}
+          fetch-depth: 0
 
       - name: Restore Lint Cache
         uses: actions/cache/restore@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
@@ -109,27 +104,19 @@ jobs:
       - name: Install packages
         run: pnpm install --frozen-lockfile
 
-      - name: Run `lint:md --fix`
-        # This runs a specific version of ESLint with only the Translation Pages Globbing
-        # This avoid that unrelated changes get linted/modified within this PR
-        run: pnpm exec eslint "apps/site/pages/**/*.md?(x)" --fix --cache --cache-strategy=metadata --cache-file=apps/site/.eslintmdcache --config=apps/site/eslint.config.js
+      # Re-stage latest commit and run lint-staged
+      - name: Re-stage and Format Files
+        run: |
+          # Soft reset to unstage the commit but keep changes
+          git reset --soft HEAD^
 
-      - name: Run `prettier --write`
-        # This runs a specific version of Prettier with only the Translation Pages Globbing
-        # This avoid that unrelated changes get prettied/modified within this PR
-        run: pnpm exec prettier "apps/site/{pages,i18n}/**/*.{json,md,mdx}" --check --write --cache --cache-strategy=metadata --cache-location=apps/site/.prettiercache
+          # Run lint-staged on the staged files
+          # This will run linters/formatters only on changed files
+          # according to the configuration in package.json or .lintstagedrc
+          pnpm lint-staged
 
-      - name: Push Changes back to Pull Request
-        uses: stefanzweifel/git-auto-commit-action@b863ae1933cb653a53c021fe36dbb774e1fb9403 # v5.2.0
-        with:
-          commit_options: '--no-verify --signoff'
-          commit_message: 'chore: automated format of translated files'
-          branch: 'chore/crowdin'
+          git commit -m "$COMMIT_MSG" --signoff
 
-      - name: Save Lint Cache
-        uses: actions/cache/save@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
-        with:
-          path: |
-            apps/site/.eslintmdcache
-            apps/site/.prettiercache
-          key: cache-lint-${{ hashFiles('pnpm-lock.yaml') }}-${{ hashFiles('apps/site/.eslintmdcache') }}
+      # Push the changes back to the PR branch
+      - name: Push Changes
+        run: git push origin HEAD:$HEAD_REF