GH#151: fix: harden translation workflow inputs

[superdav42]

Summary

Passed workflow_dispatch inputs through environment variables and used a Bash array for translate.js arguments so untrusted inputs are not template-expanded directly inside the run block.

Files Changed

.github/workflows/translate.yml

Runtime Testing

• Risk level: Low (agent prompts / infrastructure scripts)
• Verification: shellcheck -s bash on the translated run block; git diff --check

Resolves #151

---

aidevops.sh v3.31.53 plugin for OpenCode v1.17.13 with gpt-5.5 spent 2m and 68,590 tokens on this as a headless worker.

Summary by CodeRabbit

• Chores
  • Improved the translation automation workflow to handle translation options more reliably during runs.
  • Updated how translation settings are passed through, reducing issues caused by argument formatting and making the process more consistent.

[superdav42]

Completion Summary

• What: Passed workflow_dispatch inputs through environment variables and used a Bash array for translate.js arguments so untrusted inputs are not template-expanded directly inside the run block.
• Issue: Review followup: PR #150 — GH#149: use Superdav cloud translations #151
• Files changed: .github/workflows/translate.yml
• Testing: shellcheck -s bash on the translated run block; git diff --check
• Key decisions: none

---

aidevops.sh v3.31.53 plugin for OpenCode v1.17.13 with gpt-5.5 spent 2m and 68,590 tokens on this as a headless worker.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 1152435f-6513-494a-a400-0061bd62f9e4

📥 Commits

Reviewing files that changed from the base of the PR and between fd702de and fecc6fd.

📒 Files selected for processing (1)

• .github/workflows/translate.yml

---

📝 Walkthrough

Walkthrough

The GitHub Actions translate workflow's "Run translation" step was modified to read languages, force, and debug inputs into environment variables and construct CLI arguments using a Bash array, replacing the prior string-concatenation approach for invoking scripts/translate.js.

Changes

Translation Workflow Argument Handling

Layer / File(s)	Summary
Env-based inputs and array-based argument construction .github/workflows/translate.yml	LANGUAGES, FORCE, and DEBUG inputs are read into environment variables, an ARGS Bash array conditionally adds --locales, --force, and --debug flags, and the node scripts/translate.js call now uses --commit "${ARGS[@]}" with --concurrency 2 instead of the previous unquoted string-based argument passing.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Related issues: #151 (Review followup for PR #150 regarding template-injection risk in translate workflow inputs)

Suggested labels: ci, github-actions, security

Suggested reviewers: (none identified)

🐰 A rabbit hops through YAML lines so neat,
Swapping strings for arrays, oh what a feat!
Inputs now sit safe in env's embrace,
No template injection can find its place.
Hop, commit, concurrency two—workflow complete! 🥕

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title is concise and accurately reflects the workflow hardening change.
Linked Issues check	✅ Passed	The workflow now binds languages, force, and debug to env vars and uses shell variables/arrays, satisfying #151.
Out of Scope Changes check	✅ Passed	All changes are confined to the translation workflow and directly support the requested hardening.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feature/auto-20260705-032740-gh151

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}