Conversation
📝 WalkthroughSummary by CodeRabbit
WalkthroughThis PR introduces a Weblate translation sync integration: a new GitHub Actions workflow that syncs ChangesWeblate Sync Integration
Estimated code review effort: 2 (Simple) | ~12 minutes Sequence Diagram(s)sequenceDiagram
participant Trigger as Push/PR/Dispatch
participant Workflow as weblate-sync Job
participant Detect as detect-changes-action
participant Tox as tox (wlc env)
participant Weblate as Weblate Server
Trigger->>Workflow: Trigger job (if WLC_URL set)
Workflow->>Detect: Compute merge SHA, detect po/*.po changes
Detect-->>Workflow: Diff result
Workflow->>Workflow: Checkout repo, install deps
alt po files changed
Workflow->>Tox: tox -e wlc -- pull
Tox->>Weblate: Pull translations
Workflow->>Tox: tox -e wlc -- commit
Tox->>Weblate: Commit changes
Workflow->>Tox: tox -e wlc -- push
Tox->>Weblate: Push changes
Workflow->>Tox: tox -e wlc -- status
Tox->>Weblate: Fetch status
Weblate-->>Workflow: needs_commit/needs_merge/needs_push
Workflow->>Workflow: grep assert all False (PR only)
end
Related Issues: None specified Related PRs: None specified Suggested labels: ci, dependencies, translations Suggested reviewers: None specified 🐰 A rabbit hops through po and ini, 🚥 Pre-merge checks | ✅ 4✅ Passed checks (4 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
5518904 to
9b9b103
Compare
|
@coderabbitai review |
✅ Action performedReview finished.
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
requirements/wlc.txt (1)
1-31: 🔒 Security & Privacy | 🔵 Trivial | ⚡ Quick winConsider hash-pinning this lockfile.
This file feeds a tox environment that runs with
WLC_KEY/WLC_URLsecrets. Regenerating with--generate-hasheswould add integrity verification against tampered/republished packages matching the pinned version.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@requirements/wlc.txt` around lines 1 - 31, The wlc lockfile is missing package hash pins, so the tox environment relies only on version constraints. Regenerate requirements/wlc.txt with pip-compile using hash generation enabled, and keep the existing pinned packages in place so entries like requests, urllib3, and wlc include integrity hashes for tamper protection.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/weblate-sync.yml:
- Around line 68-71: The Checkout step in the weblate-sync workflow is leaving
the default git credentials in place, which triggers the artipacked warning.
Update the actions/checkout step to explicitly disable credential persistence by
setting persist-credentials to false so the GITHUB_TOKEN is not kept in git
config for the rest of the job.
- Line 7: The workflow concurrency setting currently only serializes runs, so
stale Weblate sync jobs keep queueing instead of being replaced. Update the
concurrency configuration in the weblate-sync workflow to include
cancel-in-progress: true alongside the existing concurrency group so newer runs
supersede older ones.
---
Outside diff comments:
In `@requirements/wlc.txt`:
- Around line 1-31: The wlc lockfile is missing package hash pins, so the tox
environment relies only on version constraints. Regenerate requirements/wlc.txt
with pip-compile using hash generation enabled, and keep the existing pinned
packages in place so entries like requests, urllib3, and wlc include integrity
hashes for tamper protection.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro
Run ID: 1aa7fac2-65bc-4ed8-bf28-8f2b33c7bb83
📒 Files selected for processing (5)
.github/workflows/weblate-sync.yml.weblate.inirequirements/wlc.inrequirements/wlc.txttox.ini
📜 Review details
⚠️ CI failures not shown inline (5)
GitHub Actions: pr / ci _ lint: ci: force sync with Weblate on PRs changing po/*.po
Conclusion: failure
##[group]Run if ! git diff --exit-code --color=always
�[36;1mif ! git diff --exit-code --color=always�[0m
�[36;1mthen�[0m
�[36;1m echo "::error:: meson.build formatting is incorrect. Please run: meson format -e -r -i"�[0m
GitHub Actions: pr / ci _ lint: ci: force sync with Weblate on PRs changing po/*.po
Conclusion: failure
##[group]Run if ! git diff --exit-code --color=always
�[36;1mif ! git diff --exit-code --color=always�[0m
�[36;1mthen�[0m
�[36;1m echo "::error:: PICT test cases are out of sync with models. Please run: tests/pict/gen.sh"�[0m
GitHub Actions: pr / ci _ lint: ci: force sync with Weblate on PRs changing po/*.po
Conclusion: failure
##[group]Run if ! git diff --exit-code --color=always '--ignore-matching-lines=^# This file is autogenerated by pip-compile with Python '
�[36;1mif ! git diff --exit-code --color=always '--ignore-matching-lines=^# This file is autogenerated by pip-compile with Python '�[0m
�[36;1mthen�[0m
�[36;1m echo "::error:: Python dependencies lock files are out of date. Please run: requirements/pip-compile.sh"�[0m
GitHub Actions: pr / ci _ lint: ci: force sync with Weblate on PRs changing po/*.po
Conclusion: failure
##[group]Run npm version --ignore-scripts=false --allow-same-version "$VERSION"
�[36;1mnpm version --ignore-scripts=false --allow-same-version "$VERSION"�[0m
�[36;1m�[0m
�[36;1mif ! git diff --exit-code --color=always�[0m
�[36;1mthen�[0m
�[36;1m echo "::error:: Version doesn't match across files. Run 'npm version --ignore-scripts=false'"�[0m
GitHub Actions: pr / 16_ci _ lint.txt: ci: force sync with Weblate on PRs changing po/*.po
Conclusion: failure
##[group]Run if ! git diff --exit-code --color=always
�[36;1mif ! git diff --exit-code --color=always�[0m
�[36;1mthen�[0m
�[36;1m echo "::error:: meson.build formatting is incorrect. Please run: meson format -e -r -i"�[0m
🧰 Additional context used
🧠 Learnings (2)
📚 Learning: 2026-03-08T15:48:59.252Z
Learnt from: amezin
Repo: ddterm/gnome-shell-extension-ddterm PR: 1801
File: .github/workflows/ci.yml:132-137
Timestamp: 2026-03-08T15:48:59.252Z
Learning: In CI workflows (e.g., .github/workflows/*.yml) avoid enforcing meson subprojects download in lint-like jobs if the typical developer workflow includes running meson setup, which downloads subprojects. Treat missing subproject downloads as a concern only for jobs that do not run meson setup (e.g., lint). If a workflow runs meson setup, do not flag lint entrypoints for missing subproject downloads.
Applied to files:
.github/workflows/weblate-sync.yml
📚 Learning: 2026-05-12T20:24:18.229Z
Learnt from: amezin
Repo: ddterm/gnome-shell-extension-ddterm PR: 1908
File: .github/workflows/ci.yml:309-326
Timestamp: 2026-05-12T20:24:18.229Z
Learning: In this repo’s CI workflows, assume the `meson dist` tarball includes all git-tracked files, including `.github/actions/`. After extracting the dist tarball in a CI job (e.g., `tar xvf ... --strip-components=1`), it is valid to reference local actions directly via `uses: ./.github/actions/<action>` without performing a separate `actions/checkout` step. When reviewing, ensure the workflow extracts the dist tarball before any `uses: ./.github/actions/...` and that the dist packaging indeed includes `.github/actions/`; if the dist output would omit it, require adding a checkout step or otherwise ensuring those action files are present.
Applied to files:
.github/workflows/weblate-sync.yml
🪛 zizmor (1.26.1)
.github/workflows/weblate-sync.yml
[warning] 68-71: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
[error] 9-28: use of fundamentally insecure workflow trigger (dangerous-triggers): pull_request_target is almost always used insecurely
(dangerous-triggers)
[info] 38-38: workflow or action definition without a name (anonymous-definition): this job
(anonymous-definition)
[warning] 7-7: insufficient job-level concurrency limits (concurrency-limits): workflow concurrency is missing cancel-in-progress
(concurrency-limits)
🔇 Additional comments (4)
.weblate.ini (1)
1-8: LGTM!requirements/wlc.in (1)
1-8: LGTM!tox.ini (1)
38-38: LGTM!Also applies to: 146-153
.github/workflows/weblate-sync.yml (1)
9-28: 🎯 Functional CorrectnessVerify secret exposure across the two trigger paths.
pull_request_target(lines 16-24) andpull_request(lines 25-28) are set up as complementary triggers:pull_request_targetruns for normal changes (excluding workflow/config files) with secrets, whilepull_requestruns when workflow/config files themselves change. However,WLC_KEY/WLC_URLare set unconditionally at the job level (lines 44-46), so a fork PR that only modifies.weblate.ini/requirements/wlc.*/the workflow file will trigger viapull_request, checking out untrusted PR-authored workflow/action code withWLC_KEYreferenced inenv. This relies on GitHub's built-in secret redaction for fork PRs on thepull_requestevent to prevent actual leakage — please confirm that assumption holds for this org/repo configuration (e.g., not an internal fork with secret access, and nopull_request_target-adjacent quirks with reusedpaths/paths-ignoreanchors).Static analysis also flags
pull_request_target(lines 9-28) generically as adangerous-triggersrisk.Also applies to: 44-46
Source: Linters/SAST tools
|
|
||
| name: weblate-sync | ||
|
|
||
| concurrency: ${{ github.workflow }} |
There was a problem hiding this comment.
🚀 Performance & Scalability | 🔵 Trivial | ⚡ Quick win
Add cancel-in-progress to concurrency.
The concurrency group only serializes runs; without cancel-in-progress: true, stacked pushes/PR updates queue up rather than superseding stale runs, wasting CI minutes on a job that talks to an external service.
♻️ Proposed fix
-concurrency: ${{ github.workflow }}
+concurrency:
+ group: ${{ github.workflow }}
+ cancel-in-progress: true📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| concurrency: ${{ github.workflow }} | |
| concurrency: | |
| group: ${{ github.workflow }} | |
| cancel-in-progress: true |
🧰 Tools
🪛 zizmor (1.26.1)
[warning] 7-7: insufficient job-level concurrency limits (concurrency-limits): workflow concurrency is missing cancel-in-progress
(concurrency-limits)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/weblate-sync.yml at line 7, The workflow concurrency
setting currently only serializes runs, so stale Weblate sync jobs keep queueing
instead of being replaced. Update the concurrency configuration in the
weblate-sync workflow to include cancel-in-progress: true alongside the existing
concurrency group so newer runs supersede older ones.
Source: Linters/SAST tools
| - name: Checkout | ||
| # Do some testing if workflow files/dependencies were modified, even if po files weren't changed | ||
| if: ${{ steps.diff.outputs.changed != 'false' || github.event_name == 'pull_request' }} | ||
| uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟡 Minor | ⚡ Quick win
Add persist-credentials: false to checkout.
The checkout step doesn't disable credential persistence, so the ephemeral GITHUB_TOKEN remains in the git config for the rest of the job. Static analysis (zizmor) flags this as artipacked.
🔒️ Proposed fix
- name: Checkout
# Do some testing if workflow files/dependencies were modified, even if po files weren't changed
if: ${{ steps.diff.outputs.changed != 'false' || github.event_name == 'pull_request' }}
uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+ with:
+ persist-credentials: false📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| - name: Checkout | |
| # Do some testing if workflow files/dependencies were modified, even if po files weren't changed | |
| if: ${{ steps.diff.outputs.changed != 'false' || github.event_name == 'pull_request' }} | |
| uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| - name: Checkout | |
| # Do some testing if workflow files/dependencies were modified, even if po files weren't changed | |
| if: ${{ steps.diff.outputs.changed != 'false' || github.event_name == 'pull_request' }} | |
| uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| with: | |
| persist-credentials: false |
🧰 Tools
🪛 zizmor (1.26.1)
[warning] 68-71: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/weblate-sync.yml around lines 68 - 71, The Checkout step
in the weblate-sync workflow is leaving the default git credentials in place,
which triggers the artipacked warning. Update the actions/checkout step to
explicitly disable credential persistence by setting persist-credentials to
false so the GITHUB_TOKEN is not kept in git config for the rest of the job.
Source: Linters/SAST tools
1 participant
#1591