🔧 chore(i18n): sync translations from Crowdin - #618
Closed
github-actions[bot] wants to merge 5 commits into
Closed
Conversation
Routine dev → main sync, per the branch model (main only advances by merging from dev/v1.6). This one carries the CI-hardening and bot-config batch: - #590/#592 drift guard + integration-branch targeting (already on dev, now visible to the bot: Renovate reads renovate.json from the default branch, so baseBranchPatterns and skipInstalls only take effect on main) - #594 skipInstalls: false + the lockfile-sync guard (runs npm's own ci --dry-run check per workspace) - #593 .planning untracked + tracked-ignored-files guard - #545 Crowdin translation sync with all 21 review comments fixed upstream - Five Renovate dependency batches (#484/#485/#487/#489/#510) - postcss override 8.5.22 (GHSA-r28c-9q8g-f849) After merge, `git diff origin/main origin/dev/v1.6` must be empty (tree equality — the invariant release-cut enforces). --------- Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: Crowdin Bot <support+bot@crowdin.com>
Routine dev → main sync, per the branch model: main only advances by merging from `dev/v1.6`, never by taking independent commits. Opened from a throwaway `sync/main-20260726` branch rather than from `dev/v1.6` directly. Last time (#596) the head was `dev/v1.6` itself, and auto-delete-head-branches deleted it on merge — which is what broke the Crowdin sync, since its base resolver then found no `dev/v*` on origin. ## What this carries 48 files. Two things worth calling out: **Clears the CVE failing main's scheduled scan.** `brace-expansion` goes 5.0.7 → 5.0.8 in `app/`, `ui/`, and `e2e/` lockfiles, fixing CVE-2026-14257 / GHSA-mh99-v99m-4gvg (medium, DoS via unbounded expansion). 5.0.8 is the fixed version per OSV. This is the sole cause of the "🔬 CI Verify — main" failures on the twice-weekly schedule; the `--all` qlty gate flags it in all three lockfiles. No code change was needed, dev already had the bump. **The pipefail dead-fallback fixes (#599).** The Crowdin base-branch resolver and 8 load-test `find` pipelines in `ci-verify.yml`, where a command exiting non-zero on an empty result aborted the step before its explicit fallback could run. Both covered by new tests in `.github/tests/`. Plus the #587 maturity-cleared notification feature and its store/trigger plumbing. ## Notes - `renovate.json` still targets `dev/v1.6`, which matches the active dev branch, so the drift guard's bot-target assertion passes. - Commit-count comparisons between these branches are meaningless here — the repo is squash-merge-only, so dev's commits never become ancestors of main. Tree equality is the real invariant, and that's what `release-cut.yml` asserts. - No release tag is being cut by this PR. This is the routine sync that keeps main current. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ✨ Added - Maturity gate sweep scheduler with configurable cron execution. - `maturityGatePendingSince` lifecycle tracking across containers and persistence. - `maturity-cleared` events, audit entries, notification rules, templates, deduplication, UI support, and documentation. - Extensive unit and workflow tests. 🔧 Changed - Controller and watcher startup/shutdown now manage the maturity scheduler. - Container processing checks for cleared maturity gates before emitting reports. - Crowdin branch resolution and load-test report discovery now tolerate empty `find`/branch results. - `brace-expansion` upgraded to `5.0.8` across lockfiles. 🔒 Security - Dependency update addresses CVE-2026-14257 / GHSA-mh99-v99m-4gvg. - Verify the synchronized tree matches `dev/v1.6` exactly. - Confirm `renovate.json` continues targeting `dev/v1.6`. - Ensure no release tag is created by this synchronization. - Validate maturity-cleared notification behavior across watch cycles, scheduled sweeps, deduplication, and failed deliveries. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: Crowdin Bot <support+bot@crowdin.com>
Routine dev → main sync ahead of cutting `v1.6.0-rc.6`. Per the branch model, `main` only advances by merging from `dev/v1.6`, never by taking independent commits, and the cut is dispatched from `main`. Opened from a throwaway `sync/main-rc6` branch rather than from `dev/v1.6` directly. Auto-delete-head-branches deleted `dev/v1.6` when sync PR #596 used it as the head, which is what broke the Crowdin sync. ## Content The entire delta is the rc.6 prep merged in #602: the dated `[1.6.0-rc.6]` changelog entry and the 16-file release identity bump. ## Conflict resolution The three-way merge conflicted on `CHANGELOG.md`. That's an artifact of squash-merge-only ancestry — `main` picked up the same content through an earlier squash, so the merge reads both sides as independently adding it. Resolved with `git merge -s ours origin/main`, which takes `dev/v1.6`'s tree wholesale. Verified that loses nothing: - No file exists only on `main` - The complete content diff between `main` and `dev/v1.6` is exactly the 17 rc.6 prep files, nothing else After the merge, `git diff HEAD origin/dev/v1.6` is empty, so this branch's tree is byte-identical to `dev/v1.6`. That's the invariant the release-cut drift guard asserts. ## Verification - Full pre-push gate green: qlty, qlty-smells, scripts-test, workflow-tests, typecheck-ui, web-scripts-test, coverage, build, zizmor - `renovate.json` already targets `dev/v1.6`, so the drift guard's bot-target assertion passes - All eight version files sit at the `1.6.0` base that the tag validation expects Next after merge: dispatch `release-cut.yml --ref main -f release_tag=v1.6.0-rc.6`. --------- Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: Crowdin Bot <support+bot@crowdin.com>
Routine pre-cut sync: takes `dev/v1.6` (`391c1b7d`) wholesale onto `main` so the rc.7 tag cuts from a tree identical to the dev branch. Delta since the rc.6 sync (#603): - #607 — four identity-drift fixes (soak-clock recreate reset, notification dedup double-fire, scan write-back revert, update-age fallback leak) - #608 — icon-bundle regenerated against the locked iconify versions - #609 — rc.7 release-surface prep (CHANGELOG heading, 17-file identity bump) Head branch is a throwaway (`sync/main-20260726-rc7`), not `dev/v1.6`, so auto-delete-head-branches can't touch the dev branch (#596 lesson). <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Changelog - 🐛 Fixed identity drift across maturity tracking, notification deduplication, and scan write-back. - 🐛 Prevented stale or removed containers from being overwritten or resurrected during scans. - ✨ Added shared candidate-identity extraction and raw-container access APIs. - 🔧 Updated maturity/age filtering and sorting behavior and expanded regression coverage. - 🔧 Regenerated the server icon bundle. - 🔧 Bumped release surfaces, documentation, mocks, and validation tests from `v1.6.0-rc.6` to `v1.6.0-rc.7`. - ✨ Added `v1.6.0-rc.7` release highlights and GA-compatible release-surface checks. <!-- end of auto-generated comment: release notes by coderabbit.ai -->
github-actions
Bot
requested review from
ALARGECOMPANY,
biggest-littlest and
scttbnsn
as code owners
July 27, 2026 10:42
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
scttbnsn
added a commit
that referenced
this pull request
Jul 27, 2026
…619) The Crowdin workflow checks out the triggering ref, which is `main` whenever a dev→main sync merge touches locale files. The crowdin action then forked `l10n_crowdin` from main's squash history while opening the PR against the dev base, leaving the translation PR permanently CONFLICTING (#601, #618 — closing #601 didn't cure it because the next run recreated the branch the same broken way). Fix: after resolving the integration branch, fetch it and switch to it before the crowdin action runs, so `l10n_crowdin` forks from the branch the PR actually targets. BASE is passed via `env` (no inline template interpolation in `run:`). Covered by a new workflow test asserting the step's position (after `base`, before the crowdin action), env wiring, and fetch-before-checkout ordering. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Changelog - 🔧 Changed Crowdin workflow to fetch and check out the resolved integration branch before running the Crowdin action. - 🐛 Fixed translation PRs being based on the triggering ref during `dev` → `main` syncs, preventing persistent conflicts. - ✨ Added workflow tests covering step ordering, `BASE` configuration, and fetch-before-checkout behavior. ## Concerns - Verify the resolved `BASE` branch always exists on `origin` before checkout. <!-- end of auto-generated comment: release notes by coderabbit.ai -->
Contributor
|
Closing: this PR's branch was forked from main's squash history by the workflow bug fixed in #619, so it can never merge cleanly. The next Crowdin sync run will recreate the branch correctly from the integration branch. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Automated sync from Crowdin. Review wording, then merge.