name: Translation Validation

permissions:
  contents: read

on:
  pull_request:
    types: [opened, synchronize, reopened]
  push:
    branches:
      - main

jobs:
  validate-translations:
    name: Validate Translation Keys
    runs-on: ubuntu-latest
    timeout-minutes: 10

    steps:
      - name: Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0 # v2.12.0
        with:
          egress-policy: audit

      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

      - name: Check for relevant changes
        id: changes
        uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # v3.0.2
        with:
          filters: |
            translations:
              - 'apps/web/**/*.ts'
              - 'apps/web/**/*.tsx'
              - 'apps/web/locales/**/*.json'
              - 'packages/surveys/src/**/*.{ts,tsx}'
              - 'packages/surveys/locales/**/*.json'
              - 'packages/email/**/*.{ts,tsx}'

      - name: Setup Node.js 22.x
        if: steps.changes.outputs.translations == 'true'
        uses: actions/setup-node@39370e3970a6d050c480ffad4ff0ed4d3fdee5af
        with:
          node-version: 22.x

      - name: Install pnpm
        if: steps.changes.outputs.translations == 'true'
        uses: pnpm/action-setup@a7487c7e89a18df4991f7f222e4898a00d66ddda # v4.1.0

      - name: Install dependencies
        if: steps.changes.outputs.translations == 'true'
        run: pnpm install --config.platform=linux --config.architecture=x64

      - name: Validate translation keys
        if: steps.changes.outputs.translations == 'true'
        run: pnpm run scan-translations

      - name: Skip (no translation-related changes)
        if: steps.changes.outputs.translations != 'true'
        run: echo "No translation-related files changed — skipping validation."