Stirling-PDF/.github/workflows/check_toml.yml

name: Check TOML Translation Files on PR

# This workflow validates TOML translation files

on:
  pull_request_target:
    types: [opened, synchronize, reopened]
    paths:
      - "frontend/editor/public/locales/*/translation.toml"
      - ".github/scripts/check_language_toml.py"
      - ".github/workflows/check_toml.yml"

# cancel in-progress jobs if a new job is triggered
concurrency:
  group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.event.pull_request.number || github.ref_name || github.ref }}
  cancel-in-progress: true

permissions:
  contents: read # Allow read access to repository content

jobs:
  check-files:
    if: github.event_name == 'pull_request_target'
    runs-on: ubuntu-latest
    permissions:
      contents: read # Checkout, and read translation files via the contents API
      issues: write # Allow posting comments on issues/PRs
      pull-requests: write # Allow writing to pull requests
    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1
        with:
          egress-policy: audit

      - name: Checkout main branch first
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - name: Get PR data
        id: get-pr-data
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
        with:
          github-token: ${{ github.token }}
          script: |
            const prNumber = context.payload.pull_request.number;
            const repoOwner = context.payload.repository.owner.login;
            const repoName = context.payload.repository.name;
            const branch = context.payload.pull_request.head.ref;

            console.log(`PR Number: ${prNumber}`);
            console.log(`Repo Owner: ${repoOwner}`);
            console.log(`Repo Name: ${repoName}`);
            console.log(`Branch: ${branch}`);

            core.setOutput("pr_number", prNumber);
            core.setOutput("repo_owner", repoOwner);
            core.setOutput("repo_name", repoName);
            core.setOutput("branch", branch);
        continue-on-error: true

      - name: Fetch PR changed files
        id: fetch-pr-changes
        env:
          GH_TOKEN: ${{ github.token }}
          PR_NUMBER: ${{ steps.get-pr-data.outputs.pr_number }}
        run: |
          echo "Fetching PR changed files..."
          echo "Getting list of changed files from PR..."
          # Check if PR number exists
          if [ -z "${PR_NUMBER}" ]; then
            echo "Error: PR number is empty"
            exit 1
          fi
          # Get changed files and filter for TOML translation files
          gh pr view "${PR_NUMBER}" --json files -q ".files[].path" | grep -E '^frontend/editor/public/locales/[a-zA-Z-]+/translation\.toml$' > changed_files.txt || echo "No matching TOML files found in PR"
          # Check if any files were found
          if [ ! -s changed_files.txt ]; then
            echo "No TOML translation files changed in this PR"
            echo "Workflow will exit early as no relevant files to check"
            exit 0
          fi
          echo "Found $(wc -l < changed_files.txt) matching TOML files"

      - name: Determine reference file
        id: determine-file
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
        env:
          # Untrusted, fork-controlled values are passed via env, never interpolated into the script
          PR_NUMBER: ${{ steps.get-pr-data.outputs.pr_number }}
          REPO_OWNER: ${{ steps.get-pr-data.outputs.repo_owner }}
          REPO_NAME: ${{ steps.get-pr-data.outputs.repo_name }}
          PR_REPO_OWNER: ${{ github.event.pull_request.head.repo.owner.login }}
          PR_REPO_NAME: ${{ github.event.pull_request.head.repo.name }}
          PR_BRANCH: ${{ steps.get-pr-data.outputs.branch }}
        with:
          github-token: ${{ github.token }}
          script: |
            const fs = require("fs");
            const path = require("path");

            // Validate inputs before any use
            const validateInput = (input, regex, name) => {
              if (typeof input !== "string" || !regex.test(input)) {
                throw new Error(`Invalid ${name}: ${input}`);
              }
              return input;
            };

            const repoOwner = validateInput(process.env.REPO_OWNER, /^[a-zA-Z0-9_-]+$/, "repository owner");
            const repoName = validateInput(process.env.REPO_NAME, /^[a-zA-Z0-9._-]+$/, "repository name");
            const prRepoOwner = validateInput(process.env.PR_REPO_OWNER, /^[a-zA-Z0-9_-]+$/, "PR repository owner");
            const prRepoName = validateInput(process.env.PR_REPO_NAME, /^[a-zA-Z0-9._-]+$/, "PR repository name");
            const branch = validateInput(process.env.PR_BRANCH, /^[a-zA-Z0-9._/-]+$/, "branch name");
            const prNumber = Number(validateInput(process.env.PR_NUMBER, /^[0-9]+$/, "PR number"));

            console.log(`Determining reference file for PR #${prNumber}`);

            // Get the list of changed files in the PR
            const { data: files } = await github.rest.pulls.listFiles({
              owner: repoOwner,
              repo: repoName,
              pull_number: prNumber,
            });

            // Filter for relevant TOML files based on the PR changes
            const changedFiles = files
              .filter(file =>
                file.status !== "removed" &&
                /^frontend\/editor\/public\/locales\/[a-zA-Z-]+\/translation\.toml$/.test(file.filename)
              )
              .map(file => file.filename);

            console.log("Changed files:", changedFiles);

            // Create a temporary directory for PR files
            const tempDir = "pr-branch";
            if (!fs.existsSync(tempDir)) {
              fs.mkdirSync(tempDir, { recursive: true });
            }

            // Download and save each changed file
            for (const file of changedFiles) {
              const { data: fileContent } = await github.rest.repos.getContent({
                owner: prRepoOwner,
                repo: prRepoName,
                path: file,
                ref: branch,
              });

              const content = Buffer.from(fileContent.content, "base64").toString("utf-8");
              const filePath = path.join(tempDir, file);
              const dirPath = path.dirname(filePath);

              if (!fs.existsSync(dirPath)) {
                fs.mkdirSync(dirPath, { recursive: true });
              }

              fs.writeFileSync(filePath, content);
              console.log(`Saved file: ${filePath}`);
            }

            // Output the list of changed files for further processing
            const fileList = changedFiles.join(" ");
            core.exportVariable("FILES_LIST", fileList);
            console.log("Files saved and listed in FILES_LIST.");

            // Determine reference file
            let referenceFilePath;
            if (changedFiles.includes("frontend/editor/public/locales/en-US/translation.toml")) {
              console.log("Using PR branch reference file.");
              const { data: fileContent } = await github.rest.repos.getContent({
                owner: prRepoOwner,
                repo: prRepoName,
                path: "frontend/editor/public/locales/en-US/translation.toml",
                ref: branch,
              });

              referenceFilePath = "pr-branch-translation-en-US.toml";
              const content = Buffer.from(fileContent.content, "base64").toString("utf-8");
              fs.writeFileSync(referenceFilePath, content);
            } else {
              console.log("Using main branch reference file.");
              const { data: fileContent } = await github.rest.repos.getContent({
                owner: repoOwner,
                repo: repoName,
                path: "frontend/editor/public/locales/en-US/translation.toml",
                ref: "main",
              });

              referenceFilePath = "main-branch-translation-en-US.toml";
              const content = Buffer.from(fileContent.content, "base64").toString("utf-8");
              fs.writeFileSync(referenceFilePath, content);
            }

            console.log(`Reference file path: ${referenceFilePath}`);
            core.exportVariable("REFERENCE_FILE", referenceFilePath);

      - name: Install uv
        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
        with:
          enable-cache: true
          cache-dependency-glob: |
            engine/pyproject.toml
            engine/uv.lock

      - name: Install Python dependencies
        run: |
          uv sync --project engine --locked --group tools

      - name: Run Python script to check files
        id: run-check
        env:
          PR_ACTOR: ${{ github.event.pull_request.user.login }}
        run: |
          echo "Running Python script to check TOML files..."
          uv run --project engine --locked --group tools python .github/scripts/check_language_toml.py \
            --actor "${PR_ACTOR}" \
            --reference-file "${REFERENCE_FILE}" \
            --branch "pr-branch" \
            --files "${FILES_LIST[@]}" > result.txt
        continue-on-error: true # Continue the job even if this step fails

      - name: Capture output
        id: capture-output
        run: |
          if [ -f result.txt ] && [ -s result.txt ]; then
            echo "Capturing output..."
            SCRIPT_OUTPUT=$(cat result.txt)
            echo "SCRIPT_OUTPUT<<EOF" >> $GITHUB_ENV
            echo "$SCRIPT_OUTPUT" >> $GITHUB_ENV
            echo "EOF" >> $GITHUB_ENV
            echo "${SCRIPT_OUTPUT}"

            # Determine job failure based on script output
            if [[ "$SCRIPT_OUTPUT" == *"❌"* ]]; then
              echo "FAIL_JOB=true" >> $GITHUB_ENV
            else
              echo "FAIL_JOB=false" >> $GITHUB_ENV
            fi
          else
            echo "No output found."
            echo "SCRIPT_OUTPUT=" >> $GITHUB_ENV
            echo "FAIL_JOB=false" >> $GITHUB_ENV
          fi

      - name: Post comment on PR
        if: env.SCRIPT_OUTPUT != ''
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
        with:
          github-token: ${{ github.token }}
          script: |
            const { GITHUB_REPOSITORY, SCRIPT_OUTPUT } = process.env;
            const [repoOwner, repoName] = GITHUB_REPOSITORY.split('/');
            const issueNumber = context.issue.number;

            // Find existing comment
            const comments = await github.rest.issues.listComments({
              owner: repoOwner,
              repo: repoName,
              issue_number: issueNumber
            });

            const comment = comments.data.find(c => c.body.includes("## 🌐 TOML Translation Verification Summary"));

            // Only update or create comments by the action user
            const expectedActor = "github-actions[bot]";

            if (comment && comment.user.login === expectedActor) {
              // Update existing comment
              await github.rest.issues.updateComment({
                owner: repoOwner,
                repo: repoName,
                comment_id: comment.id,
                body: `## 🌐 TOML Translation Verification Summary\n\n\n${SCRIPT_OUTPUT}\n`
              });
              console.log("Updated existing comment.");
            } else if (!comment) {
              // Create new comment if no existing comment is found
              await github.rest.issues.createComment({
                owner: repoOwner,
                repo: repoName,
                issue_number: issueNumber,
                body: `## 🌐 TOML Translation Verification Summary\n\n\n${SCRIPT_OUTPUT}\n`
              });
              console.log("Created new comment.");
            } else {
              console.log("Comment update attempt denied. Actor does not match.");
            }

      - name: Fail job if errors found
        if: env.FAIL_JOB == 'true'
        run: |
          echo "Failing the job because errors were detected."
          exit 1

      - name: Cleanup temporary files
        if: always()
        run: |
          echo "Cleaning up temporary files..."
          rm -rf pr-branch
          rm -f pr-branch-translation-en-US.toml main-branch-translation-en-US.toml changed_files.txt result.txt
          echo "Cleanup complete."
        continue-on-error: true # Ensure cleanup runs even if previous steps fail