name: Translation Validation

permissions:
  contents: read

on:
  pull_request:
    types: [opened, synchronize, reopened]
    paths:
      - "apps/web/**/*.ts"
      - "apps/web/**/*.tsx"
      - "apps/web/locales/**/*.json"
      - "scan-translations.ts"
  push:
    branches:
      - main
    paths:
      - "apps/web/**/*.ts"
      - "apps/web/**/*.tsx"
      - "apps/web/locales/**/*.json"
      - "scan-translations.ts"

jobs:
  validate-translations:
    name: Validate Translation Keys
    runs-on: ubuntu-latest
    timeout-minutes: 10

    steps:
      - name: Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0 # v2.12.0
        with:
          egress-policy: audit

      - name: Checkout repository
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

      - name: Setup Node.js
        uses: actions/setup-node@1d0ff469b7ec7b3cb9d8673fde0c81c44821de2a # v4.2.0
        with:
          node-version: 18

      - name: Setup pnpm
        uses: pnpm/action-setup@a3252b78c470c02df07e9d59298aecedc3ccdd6d # v3.0.0
        with:
          version: 9.15.9

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Validate translation keys
        run: |
          echo ""
          echo "🔍 Validating translation keys..."
          echo ""
          pnpm run scan-translations

      - name: Summary
        if: success()
        run: |
          echo ""
          echo "✅ Translation validation completed successfully!"
          echo ""
