# Base CI template which is called from i18n-ci-pr.yml

name: i18n CI Template
on:
  workflow_call:
    secrets:
      # Only the FIPS half of setup-buildenv needs these, and it is skipped on
      # fork PRs, so they are optional.
      DOCKERHUB_USERNAME:
        required: false
      DOCKERHUB_TOKEN:
        required: false

permissions:
  contents: read

# Translations used to arrive exclusively through Weblate, so this workflow's
# only job failed any PR that touched a non-English file unless it came from the
# weblate account. Translations may now be authored in-repo and land in the same
# PR as the English string, so the change is reported instead of rejected -- and,
# below, actually checked.
#
# Missing keys are reported as warnings rather than errors: the catalogs are tens
# of thousands of entries short of parity, and a hard gate is only fair once a
# contributor adding a string has a documented way to produce the other 21
# locales. Everything else here is a hard failure.
jobs:
  buildenv:
    name: Build Environment
    runs-on: ubuntu-22.04
    permissions:
      contents: read
      id-token: write  # for chainguard (FIPS base image pull)
    outputs:
      build-server-tag: ${{ steps.calculate.outputs.BUILD_SERVER_TAG }}
    steps:
      - name: ci/checkout-repo
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false

      - name: ci/calculate-build-image-tag
        id: calculate
        working-directory: server/
        run: |
          tag=$(./build/buildenv-tag.sh)
          echo "BUILD_SERVER_TAG=${tag}" >> "${GITHUB_OUTPUT}"

      - name: ci/setup-buildenv
        env:
          CHAINCTL_IDENTITY: ee399b4c72dd4e58e3d617f78fc47b74733c9557/922f2d48307d6f5f
          DOCKERHUB_USERNAME: ${{ secrets.DOCKERHUB_USERNAME }}
          DOCKERHUB_TOKEN: ${{ secrets.DOCKERHUB_TOKEN }}
        uses: ./.github/actions/setup-buildenv
        with:
          build-server-tag: ${{ steps.calculate.outputs.BUILD_SERVER_TAG }}

  check-files:
    name: Report non-English translation file changes
    runs-on: ubuntu-22.04
    steps:
      - name: Checkout code
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false

      - name: Get changed files
        id: changed-files
        uses: tj-actions/changed-files@22103cc46bda19c2b464ffe86db46df6922fd323 # v47.0.5
        with:
          files: |
            server/i18n/*.json
            webapp/channels/src/i18n/*.json
            !server/i18n/en.json
            !webapp/channels/src/i18n/en.json

      - name: Check changed files
        if: steps.changed-files.outputs.any_changed == 'true'
        run: |
          echo "::warning title=Non-English i18n files changed::This PR modifies non-English translation files directly. Ensure the changes are intentional and will not be overwritten by Weblate."

  verify-webapp:
    name: Verify webapp translation files
    runs-on: ubuntu-24.04
    defaults:
      run:
        working-directory: webapp
    steps:
      - name: ci/checkout-repo
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false

      - name: ci/setup
        uses: ./.github/actions/webapp-setup
        with:
          read-only: "true"

      - name: ci/i18n-verify-translations
        working-directory: webapp/channels
        run: |
          npm run i18n-verify-translations -- --warn-missing-keys

  verify-server:
    name: Verify server translation files
    needs: buildenv
    runs-on: ubuntu-24.04
    steps:
      - name: ci/checkout-repo
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false

      - name: ci/restore-go-cache
        uses: ./.github/actions/restore-go-cache

      - name: ci/i18n-verify
        uses: ./.github/actions/run-in-buildenv
        with:
          build-server-tag: ${{ needs.buildenv.outputs.build-server-tag }}
          run: make i18n-verify