grafana/.github/workflows/i18n-crowdin-download.yml

name: Crowdin Download Action

on:
  workflow_dispatch:
  schedule:
    - cron: "0 0 * * *"

jobs:
  download-sources-from-crowdin:
    runs-on: ubuntu-latest

    permissions:
      contents: write # needed to commit changes into the PR
      pull-requests: write # needed to update PR description, labels, etc
      id-token: write # needed to get vault secrets

    steps:
      - name: "Get vault secrets"
        id: vault-secrets
        uses: grafana/shared-workflows/actions/get-vault-secrets@main # zizmor: ignore[unpinned-uses]
        with:
          # Vault secret paths:
          # - ci/repo/grafana/grafana/grafana_frontend_platform_crowdin_bot
          repo_secrets: |
            CROWDIN_TOKEN=grafana_frontend_platform_crowdin_bot:access_token
            GRAFANA_PR_AUTOMATION_APP_ID=grafana_pr_automation_app:app_id
            GRAFANA_PR_AUTOMATION_APP_PEM=grafana_pr_automation_app:app_pem            

      - name: Generate token
        id: generate_token
        uses: tibdex/github-app-token@b62528385c34dbc9f38e5f4225ac829252d1ea92
        with:
          app_id: ${{ env.GRAFANA_PR_AUTOMATION_APP_ID }}
          private_key: ${{ env.GRAFANA_PR_AUTOMATION_APP_PEM }}

      - uses: actions/checkout@v4
        with:
          ref: ${{ github.head_ref }}
          token: ${{ steps.generate_token.outputs.token }}
          persist-credentials: false

      - name: Download sources
        id: crowdin-download
        uses: crowdin/github-action@b8012bd5491b8aa8578b73ab5b5f5e7c94aaa6e2
        with:
          upload_sources: false
          upload_translations: false
          download_sources: false
          download_translations: true
          export_only_approved: true
          localization_branch_name: i18n_crowdin_translations
          create_pull_request: true
          pull_request_title: 'I18n: Download translations from Crowdin'
          pull_request_body:  |
            :robot: Automatic download of translations from Crowdin.

            This runs once per day and will merge automatically if all the required checks pass.

            If there's a conflict, close the pull request and **delete the branch**.
            You can then either wait for the schedule to trigger a new PR, or rerun the action manually.            
          pull_request_labels: 'area/frontend, area/internationalization, no-changelog, no-backport'
          pull_request_base_branch_name: 'main'
          base_url: 'https://grafana.api.crowdin.com'
          config: 'crowdin.yml'
          source: 'public/locales/en-US/grafana.json'
          translation: 'public/locales/%locale%/%original_file_name%'
          # Magic details of the github-actions bot user, to pass CLA checks
          github_user_name: "github-actions[bot]"
          github_user_email: "41898282+github-actions[bot]@users.noreply.github.com"
        env:
          GITHUB_TOKEN: ${{ steps.generate_token.outputs.token }}
          CROWDIN_PROJECT_ID: 5
          CROWDIN_PERSONAL_TOKEN: ${{ env.CROWDIN_TOKEN }}

      - name: Get pull request ID
        if: steps.crowdin-download.outputs.pull_request_url
        shell: bash
        # Crowdin action returns us the URL of the pull request, but we need an ID for the GraphQL API
        # that looks like 'PR_kwDOAOaWjc5mP_GU'
        run: |
          pr_id=$(gh pr view ${{ steps.crowdin-download.outputs.pull_request_url }} --json id -q .id)
          echo "PULL_REQUEST_ID=$pr_id" >> "$GITHUB_ENV"          
        env:
          GITHUB_TOKEN: ${{ steps.generate_token.outputs.token }}

      - name: Get project board ID
        uses: octokit/graphql-action@51bf543c240dcd14761320e2efc625dc32ec0d32
        id: get-project-id
        if: steps.crowdin-download.outputs.pull_request_url
        with:
          # Frontend Platform project - https://github.com/orgs/grafana/projects/78
          org: grafana
          project_number: 78
          query: |
            query getProjectId($org: String!, $project_number: Int!){
              organization(login: $org) {
                projectV2(number: $project_number) {
                  title
                  id
                }
              }
            }            
        env:
          GITHUB_TOKEN: ${{ steps.generate_token.outputs.token }}

      - name: Add to project board
        uses: octokit/graphql-action@51bf543c240dcd14761320e2efc625dc32ec0d32
        if: steps.crowdin-download.outputs.pull_request_url
        with:
          projectid: ${{ fromJson(steps.get-project-id.outputs.data).organization.projectV2.id }}
          prid: ${{ env.PULL_REQUEST_ID }}
          query: |
            mutation addPullRequestToProject($projectid: ID!, $prid: ID!){
              addProjectV2ItemById(input: {projectId: $projectid, contentId: $prid}) {
                item {
                  id
                }
              }
            }            
        env:
          GITHUB_TOKEN: ${{ steps.generate_token.outputs.token }}

      - name: Run auto-milestone
        uses: grafana/grafana-github-actions-go/auto-milestone@main # zizmor: ignore[unpinned-uses]
        if: steps.crowdin-download.outputs.pull_request_url
        with:
          pr: ${{ steps.crowdin-download.outputs.pull_request_number }}
          token: ${{ steps.generate_token.outputs.token }}

      - name: Get vault secrets
        id: vault-secrets-approver
        uses: grafana/shared-workflows/actions/get-vault-secrets@main # zizmor: ignore[unpinned-uses]
        with:
          # Secrets placed in ci/repo/grafana/grafana/grafana-pr-approver
          repo_secrets: |
            GRAFANA_PR_APPROVER_APP_ID=grafana-pr-approver:app-id
            GRAFANA_PR_APPROVER_APP_PEM=grafana-pr-approver:private-key            

      - name: Generate approver token
        if: steps.crowdin-download.outputs.pull_request_url
        id: generate_approver_token
        uses: tibdex/github-app-token@b62528385c34dbc9f38e5f4225ac829252d1ea92
        with:
          app_id: ${{ env.GRAFANA_PR_APPROVER_APP_ID }}
          private_key: ${{ env.GRAFANA_PR_APPROVER_APP_PEM }}

      - name: Approve and automerge PR
        if: steps.crowdin-download.outputs.pull_request_url
        shell: bash
        # Only approve if:
        # - the PR does not modify files other than json files under the public/locales/ directory
        # - the PR does not modify the en-US locale
        run: |
          filesChanged="$(gh pr diff --name-only "$PR_URL")"

          if [[ $(echo "$filesChanged" | grep -cv 'public/locales/[a-zA-Z\-]*/grafana.json') -ne 0 ]]; then
            echo "Non-i18n changes detected, not approving"
            exit 1
          fi

          if [[ $(echo "$filesChanged" | grep -c "public/locales/en-US") -ne 0 ]]; then
            echo "public/locales/en-US changes detected, not approving"
            exit 1
          fi

          echo "Approving and enabling automerge"
          gh pr review "$PR_URL" --approve
          gh pr merge --auto --squash "$PR_URL"          
        env:
          GITHUB_TOKEN: ${{ steps.generate_approver_token.outputs.token }}
          PR_URL: ${{ steps.crowdin-download.outputs.pull_request_url }}