From b701533196ca7a0c2c3c3e54b8d55c6387b23a20 Mon Sep 17 00:00:00 2001
From: Jared-dz <jared@doublezero.us>
Date: Thu, 21 May 2026 12:39:25 -0400
Subject: [PATCH] ci(translate): trigger on pull_request, commit translations
 to PR branch

The old workflow triggered on push to main and tried to git push translations
back to main, which has been rejected by branch protection since 2026-03-31
(GH013: "Changes must be made through a pull request"). Four PRs of doc edits
merged with English-only changes as a result.

Switch the trigger to pull_request (opened/synchronize/reopened) so the bot
commits .es/.fr/.zh/etc. files onto the PR head branch before merge.

- Diff base is now the PR base SHA instead of HEAD~1
- Loop guard switched to github.actor (head_commit.author is null on PR events)
- Skip fork PRs (no secret access)
- Concurrency group cancels in-progress runs on rapid pushes
---
 .github/workflows/translate.yml | 36 +++++++++++++++++++++++----------
 1 file changed, 25 insertions(+), 11 deletions(-)

diff --git a/.github/workflows/translate.yml b/.github/workflows/translate.yml
index 9cf3071..d631c13 100644
--- a/.github/workflows/translate.yml
+++ b/.github/workflows/translate.yml
@@ -1,22 +1,32 @@
 name: Auto-translate docs
 
 on:
-  push:
-    branches: [main]
+  pull_request:
+    types: [opened, synchronize, reopened]
     paths:
       - 'docs/**.md'
 
+concurrency:
+  group: translate-${{ github.head_ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: write
+  pull-requests: write
+
 jobs:
   translate:
     runs-on: ubuntu-latest
-    # Prevent infinite loop: skip when the bot itself pushes translations
-    if: github.event.head_commit.author.name != 'github-actions[bot]'
-    permissions:
-      contents: write
+    # Skip the bot's own commits (prevents loops) and fork PRs (no secret access).
+    if: >
+      github.actor != 'github-actions[bot]' &&
+      github.event.pull_request.head.repo.full_name == github.repository
     steps:
       - uses: actions/checkout@v4
         with:
-          fetch-depth: 2
+          ref: ${{ github.head_ref }}
+          fetch-depth: 0
+          token: ${{ secrets.GITHUB_TOKEN }}
 
       - uses: actions/setup-python@v5
         with:
@@ -27,7 +37,7 @@ jobs:
       - name: Find changed source docs
         id: changed
         run: |
-          BASE=$(git rev-parse HEAD~1 2>/dev/null || git hash-object -t tree /dev/null)
+          BASE="${{ github.event.pull_request.base.sha }}"
           # Only source .md files — exclude already-translated ones (e.g. index.es.md)
           CHANGED=$(git diff --name-only "$BASE" HEAD -- docs/ \
             | grep '\.md$' \
@@ -49,11 +59,15 @@ jobs:
           LANGUAGES: "zh,ja,ko,pt,es,fr,it"
         run: python scripts/translate.py
 
-      - name: Commit translations
+      - name: Commit translations to PR branch
         if: steps.changed.outputs.files != ''
         run: |
           git config user.name "github-actions[bot]"
           git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
           git add docs/
-          git diff --cached --quiet || git commit -m "chore: auto-translate docs"
-          git push
+          if git diff --cached --quiet; then
+            echo "No translation changes."
+            exit 0
+          fi
+          git commit -m "chore: auto-translate docs"
+          git push origin HEAD:${{ github.head_ref }}