v1.3.0

No breaking change. Adds the qa, qa-severity, and qa-strict inputs, which
run verbatra check --qa over every committed translation and turn each finding
into an annotation, the require-reviewed input, which runs
verbatra check --require-reviewed and fails the step while a machine-written
translation is not approved, and the needs-human output, which is "true" when
translate exits 3 in human-only mode. That exit passes the step instead of
failing it. It also adds the sensitive input, which runs
verbatra check --sensitive, and the locales input, which limits a run to a
comma-separated subset of target locales with --locales. The step now fails
before installing the CLI when node-version resolves to a Node.js outside the
pinned CLI's range (22.18.0 or newer on the 22 line, or 24 or newer for
0.12.0 and newer; 22.14.0 or newer before). check now also warns about plurals that lack a CLDR plural category
the target language uses, and a whole-run failure shows the CLI's hint as a
next step and names the code of a wrapped error. See
Check translation quality,
Require reviewed translations, and
Human-only mode.

Minimum runner: Actions Runner v2.327.1. Minimum @verbatra/cli for qa,
require-reviewed, sensitive, and exit 3: 0.12.0; every other input still works from
0.9.3.

v1.2.0

verbatra/action now requires a verbatra config to exist exactly at the resolved working-directory before it runs a command. This is a breaking change from earlier releases.

What changed

• The action fails fast, before installing anything, if no recognized verbatra config is found directly inside working-directory. The check is strict: it never looks in a parent or ancestor directory, even if one holds a valid config.
• The failure names the exact resolved path that was checked and identifies the input that controls it (working-directory, and config-path when set explicitly).
• Once a config is found, the action always passes it to the CLI explicitly via --config <resolved-path>.

Versioning model change

Starting with this release, v1 is the single actively maintained tag for this action, updated continuously as fixes and features ship. The earlier v2 prerelease has been retired. Pin uses: verbatra/action@v1 (or a specific commit SHA for the security-conscious form, shown in the README).

Upgrading

If your config file lives only in a parent directory relative to working-directory (for example, a shared config at your repository root while working-directory points at a subdirectory), add a config file directly inside working-directory before upgrading, or the action will fail fast where it previously succeeded via inherited lookup.

See the README for full usage and the config discovery documentation for details.

v1.1.4

Deprecated - migrate to v2

v1 is obsolete. This release exists only so consumers who haven't migrated yet aren't left on a version with a known critical bug. Everyone should move to verbatra/action@v2 with the latest @verbatra/cli/@verbatra/sdk version as soon as possible.

Fixed

Critical fix: the action no longer merges its scratch install into your project's node_modules (#9). This previously could corrupt or overwrite dependency versions in your checked-out tree, or crash with a raw error when a dependency name collided with one of the CLI's transitive dependencies.

No input contract changes versus prior v1.x releases.

Why v2 instead

v2 removes the underlying mechanism this bug class came from entirely (a node_modules symlink workaround), relying on a proper fix in @verbatra/sdk instead. v1, even at this patched revision, still uses that workaround for TypeScript config resolution and remains a fundamentally more fragile design. See the v2.0.0 release notes.

v1.1.3

Fixes

v1.1.2 fixed the original npx-cache resolution bug but introduced a more severe one: npm install --prefix "$install_dir" still reads and parses the consumer's existing package.json, not just the packages named on the command line. Any pnpm (or Yarn) workspace-protocol dependency string there — workspace:*, pnpm's catalog: — crashed the install outright, regardless of --no-save. Caught in the very first real-world CI run against v1.1.2, against verbatra's own docs site, whose apps/docs/package.json uses exactly this.

• Installs into an isolated scratch directory (no package.json to conflict with), then merges the result into working-directory — the consumer's own dependency manifest is never read by npm at all.
• Fixes a node_modules/.bin symlink-dereferencing issue found while diagnosing the above (only matters for the merge step, not user-visible on its own).
• Adds a pnpm-workspace-protocols regression fixture reproducing the exact failure, plus bumps all self-test fixtures to 0.9.0 (previously 0.8.0, stale).

No input or output changes; this is a drop-in upgrade.

v1.1.2

Fixes

Installing the CLI via a bare npx --yes "@verbatra/cli@$VERSION" installed into an ephemeral cache directory unrelated to the consumer's checked-out project. That broke every verbatra.config.ts/.js that imports defineConfig from @verbatra/cli or @verbatra/sdk (the pattern verbatra init itself scaffolds), since Node's module resolution walks up from the config file's own location on disk and the npx cache is never an ancestor of that path. Every consumer using the default TypeScript config format hit CONFIG_INVALID on every run.

• Installs @verbatra/cli and @verbatra/sdk at the pinned version into working-directory (or the repo root) instead of an npx ephemeral cache, so config-file imports resolve correctly regardless of which of the two packages they import from.
• Invokes the installed binary via npm exec instead of a bare node call against the .bin shim, fixing an additional Windows-runner failure (npm creates a .cmd/.ps1 shim there, not a raw JS file).
• Adds two regression fixtures (ts-config, ts-config-sdk-import) and self-test steps, since every existing fixture used a JSON config and never exercised this path at all.

No input or output changes; this is a drop-in upgrade.

v1.1.1

Metadata and documentation only. No change to the action's behavior, inputs, or outputs.

action.yml now describes what the action has done since v1.1.0: run translations in CI or gate a pull request on locale drift. The old description mentioned translation only, so the Marketplace listing hid the read-only check and diff gate that v1.1.0 shipped. The command input itself is unchanged.

Also refreshes the README, contributing guide, and security policy carried at the release tag, and folds the version bump into the release commit, so package.json and package-lock.json now read the version they ship at instead of the previous one.

verbatra/action@v1 moves to this release.

v1.1.0

Adds a command input so the action can run the CLI's read-only commands, not only translate.

command: check fails the job when a locale is missing or stale. command: diff fails it when there are pending changes, and lists the keys. Both are read-only: no provider call, no API key, no quota, so they work on pull requests from forks.

command defaults to translate, so existing workflows are unaffected. dry-run applies to translate only and is rejected with the other commands rather than ignored.

v1.0.1

Documentation only. No change to the action's behavior, inputs, or outputs.

Refreshes the README and security policy carried at the release tag, which still described the action as unpublished with no releases. The Marketplace listing renders from the default branch and was already correct; this brings the tagged tree in line.

v1.0.0

Merge pull request #1 from verbatra/chore/point-links-at-transferred-…