superset2/.github/workflows/superset-translations.yml

name: Translations

on:
  push:
    branches:
      - "master"
      - "[0-9].[0-9]*"
  pull_request:
    types: [synchronize, opened, reopened, ready_for_review]

permissions:
  contents: read
  pull-requests: read

# cancel previous workflow jobs for PRs
concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.run_id }}
  cancel-in-progress: true

jobs:
  frontend-check-translations:
    runs-on: ubuntu-24.04
    permissions:
      contents: read
      pull-requests: read
    steps:
      - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false
          submodules: recursive

      - name: Check for file changes
        id: check
        uses: ./.github/actions/change-detector/
        with:
          token: ${{ secrets.GITHUB_TOKEN }}

      - name: Setup Node.js
        if: steps.check.outputs.frontend
        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
        with:
          node-version-file: "./superset-frontend/.nvmrc"
          cache: "npm"
          cache-dependency-path: "superset-frontend/package-lock.json"
      - name: Install dependencies
        if: steps.check.outputs.frontend
        uses: ./.github/actions/cached-dependencies
        with:
          run: npm-install
      - name: lint
        if: steps.check.outputs.frontend
        working-directory: ./superset-frontend
        run: |
          npm run build-translation

  babel-extract:
    runs-on: ubuntu-24.04
    permissions:
      contents: read
      pull-requests: read
    steps:
      - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false
          submodules: recursive

      - name: Check for file changes
        id: check
        uses: ./.github/actions/change-detector/
        with:
          token: ${{ secrets.GITHUB_TOKEN }}

      - name: Setup Python
        if: steps.check.outputs.python == 'true' || steps.check.outputs.frontend == 'true'
        uses: ./.github/actions/setup-backend/

      - name: Install gettext tools
        if: steps.check.outputs.python == 'true' || steps.check.outputs.frontend == 'true'
        run: sudo apt-get update && sudo apt-get install -y gettext

      # Fetch the base ref so we can compare PR-introduced regressions
      # against a fair baseline (also runs babel_update against the base
      # source) — this isolates the PR's contribution from any pre-existing
      # drift on the base branch.
      - name: Fetch base ref and create comparison worktree
        if: steps.check.outputs.python == 'true' || steps.check.outputs.frontend == 'true'
        env:
          PR_BASE_REF: ${{ github.event.pull_request.base.ref }}
        run: |
          # For PRs use the base branch; for direct pushes compare against the previous commit.
          BASE_REF="$PR_BASE_REF"
          if [ -n "$BASE_REF" ]; then
            git fetch --depth=1 origin "$BASE_REF"
          else
            git fetch --depth=2 origin "$GITHUB_REF"
          fi
          git worktree add /tmp/base-worktree FETCH_HEAD

      # Run babel_update against BASE source + BASE translations. Any drift
      # already present on the base branch (source strings that have changed
      # without .po updates) shows up here as fuzzies — and will also show
      # up in the PR run, so it cancels out in the comparison.
      - name: Baseline — run babel_update against BASE source
        if: steps.check.outputs.python == 'true' || steps.check.outputs.frontend == 'true'
        working-directory: /tmp/base-worktree
        run: ./scripts/translations/babel_update.sh

      - name: Record baseline translation counts
        if: steps.check.outputs.python == 'true' || steps.check.outputs.frontend == 'true'
        run: |
          python scripts/translations/check_translation_regression.py \
            --count \
            --translations-dir /tmp/base-worktree/superset/translations \
            > /tmp/before.json

      # Run babel_update against the PR source and PR translations. This keeps
      # committed .po fixes in play while the base babel_update above still
      # cancels out translation drift already present on the base branch.
      - name: Run babel_update against PR source
        if: steps.check.outputs.python == 'true' || steps.check.outputs.frontend == 'true'
        run: ./scripts/translations/babel_update.sh

      - name: Check for translation regression
        id: regression
        if: steps.check.outputs.python == 'true' || steps.check.outputs.frontend == 'true'
        continue-on-error: true
        run: |
          python scripts/translations/check_translation_regression.py \
            --compare /tmp/before.json \
            --report /tmp/regression-report.md

      # Save the PR number so the comment workflow can post the report without
      # needing write permissions on this pull_request-triggered job.
      - name: Save PR number for comment workflow
        if: >-
          github.event_name == 'pull_request' &&
          steps.regression.outcome == 'failure'
        run: echo "${{ github.event.pull_request.number }}" > /tmp/pr-number.txt

      - name: Upload regression artifact
        if: >-
          github.event_name == 'pull_request' &&
          steps.regression.outcome == 'failure'
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: translation-regression
          path: |
            /tmp/regression-report.md
            /tmp/pr-number.txt

      - name: Fail if regression detected
        if: steps.regression.outcome == 'failure'
        run: exit 1