snapshot of https://github.com/mattermost/mattermost.git (master, 2026-09-16; blobs > 131072B omitted)

.github/workflows/i18n-ci-template.yml

@@ -0,0 +1,121 @@
+# Base CI template which is called from i18n-ci-pr.yml
+
+name: i18n CI Template
+on:
+  workflow_call:
+    secrets:
+      # Only the FIPS half of setup-buildenv needs these, and it is skipped on
+      # fork PRs, so they are optional.
+      DOCKERHUB_USERNAME:
+        required: false
+      DOCKERHUB_TOKEN:
+        required: false
+
+permissions:
+  contents: read
+
+# Translations used to arrive exclusively through Weblate, so this workflow's
+# only job failed any PR that touched a non-English file unless it came from the
+# weblate account. Translations may now be authored in-repo and land in the same
+# PR as the English string, so the change is reported instead of rejected -- and,
+# below, actually checked.
+#
+# Missing keys are reported as warnings rather than errors: the catalogs are tens
+# of thousands of entries short of parity, and a hard gate is only fair once a
+# contributor adding a string has a documented way to produce the other 21
+# locales. Everything else here is a hard failure.
+jobs:
+  buildenv:
+    name: Build Environment
+    runs-on: ubuntu-22.04
+    permissions:
+      contents: read
+      id-token: write  # for chainguard (FIPS base image pull)
+    outputs:
+      build-server-tag: ${{ steps.calculate.outputs.BUILD_SERVER_TAG }}
+    steps:
+      - name: ci/checkout-repo
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+
+      - name: ci/calculate-build-image-tag
+        id: calculate
+        working-directory: server/
+        run: |
+          tag=$(./build/buildenv-tag.sh)
+          echo "BUILD_SERVER_TAG=${tag}" >> "${GITHUB_OUTPUT}"
+
+      - name: ci/setup-buildenv
+        env:
+          CHAINCTL_IDENTITY: ee399b4c72dd4e58e3d617f78fc47b74733c9557/922f2d48307d6f5f
+          DOCKERHUB_USERNAME: ${{ secrets.DOCKERHUB_USERNAME }}
+          DOCKERHUB_TOKEN: ${{ secrets.DOCKERHUB_TOKEN }}
+        uses: ./.github/actions/setup-buildenv
+        with:
+          build-server-tag: ${{ steps.calculate.outputs.BUILD_SERVER_TAG }}
+
+  check-files:
+    name: Report non-English translation file changes
+    runs-on: ubuntu-22.04
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+
+      - name: Get changed files
+        id: changed-files
+        uses: tj-actions/changed-files@22103cc46bda19c2b464ffe86db46df6922fd323 # v47.0.5
+        with:
+          files: |
+            server/i18n/*.json
+            webapp/channels/src/i18n/*.json
+            !server/i18n/en.json
+            !webapp/channels/src/i18n/en.json
+
+      - name: Check changed files
+        if: steps.changed-files.outputs.any_changed == 'true'
+        run: |
+          echo "::warning title=Non-English i18n files changed::This PR modifies non-English translation files directly. Ensure the changes are intentional and will not be overwritten by Weblate."
+
+  verify-webapp:
+    name: Verify webapp translation files
+    runs-on: ubuntu-24.04
+    defaults:
+      run:
+        working-directory: webapp
+    steps:
+      - name: ci/checkout-repo
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+
+      - name: ci/setup
+        uses: ./.github/actions/webapp-setup
+        with:
+          read-only: "true"
+
+      - name: ci/i18n-verify-translations
+        working-directory: webapp/channels
+        run: |
+          npm run i18n-verify-translations -- --warn-missing-keys
+
+  verify-server:
+    name: Verify server translation files
+    needs: buildenv
+    runs-on: ubuntu-24.04
+    steps:
+      - name: ci/checkout-repo
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+
+      - name: ci/restore-go-cache
+        uses: ./.github/actions/restore-go-cache
+
+      - name: ci/i18n-verify
+        uses: ./.github/actions/run-in-buildenv
+        with:
+          build-server-tag: ${{ needs.buildenv.outputs.build-server-tag }}
+          run: make i18n-verify