v1.0.4

First public release, on the GitHub Marketplace.

Weblate's public REST API only exposes a boolean has_failing_check per translated string — it never says which check fired or why. This action fills that gap: it queries Weblate for flagged strings, scrapes each one's public translate page for the actual check name(s) and description(s), and converts everything into a SARIF file — so translation quality issues ("Reused translation", "Mismatching line breaks", "XML markup", ...) show up right in your repository's Security → Code Scanning tab, alongside CodeQL and other scanners.

---

Quick start

- uses: actions/checkout@v5   # needed so upload-sarif can resolve file paths

- name: Run Weblate quality checks
  id: weblate
  uses: e2jk/weblate-checks-action@v1
  continue-on-error: true   # a Weblate hiccup shouldn't turn this job red
  with:
    project: your-weblate-project-slug
    component: your-weblate-component-slug
    token: ${{ secrets.WEBLATE_API_TOKEN }}   # optional, see below

- name: Upload results to GitHub Code Scanning
  if: always() && hashFiles(steps.weblate.outputs.sarif-file) != ''
  uses: github/codeql-action/upload-sarif@v4
  with:
    sarif_file: ${{ steps.weblate.outputs.sarif-file }}

No Weblate login is required for a public project; an optional API token raises the anonymous rate limit (100 requests/day) to 5000/hour. Full example workflow, inputs/outputs, and options: see the README.

---

Highlights

• Auto-discovers languages from Weblate if you don't pass languages explicitly — including the source language, since Weblate runs checks against it too.
• No third-party runtime dependencies — the shipped script is pure Python standard library.
• Fuzz-tested: every function that parses external/untrusted data (scraped HTML, the Weblate API's location field, URL scheme validation) has an Atheris harness run continuously in CI.

Severity mapping

Deliberate, so Weblate findings never outrank real security findings from other scanners in the same Code Scanning list — fully overridable via warning-checks:

SARIF level	Checks	Why
warning	Format placeholders, line breaks, XML markup	Translation is actually malformed — will misrender or crash at runtime
note (lowest level)	Everything else, e.g. "Reused translation"	Content-quality hint, not a render-time break

---

Status

Originally developed and proven out inside OpenHangar (see its weblate-i18n-scan.yml for a real-world consumer) before being split out into this standalone, reusable repository.