GitHub Action

name: Fetch Tolk translations

on:
  repository_dispatch:
    types: [tolk-language-completed]
  schedule:
    - cron: '0 6 * * 1-5' # weekdays at 06:00 UTC
  workflow_dispatch:

permissions:
  contents: write
  pull-requests: write

concurrency:
  group: tolk-pull
  cancel-in-progress: false

jobs:
  pull:
    runs-on: ubuntu-latest
    env:
      TOLK_API: https://api.tolk.every-day.io/v1
      TOLK_PROFILE: laravel-json
      TOLK_TOKEN: ${{ secrets.TOLK_TOKEN }}
    steps:
      - uses: actions/checkout@v4

      - name: Fetch export
        run: |
          set -euo pipefail
          fetch() {
            curl -sS -o export.bin -D headers.txt -w '%{http_code}' \
              -H "Authorization: Bearer $TOLK_TOKEN" \
              -H 'Accept: application/json' \
              "$TOLK_API/exports/$TOLK_PROFILE"
          }
          status=$(fetch)
          if [ "$status" = "202" ]; then
            job=$(jq -r '.data.id' export.bin)
            for attempt in $(seq 1 60); do
              sleep 5
              state=$(curl -sS -H "Authorization: Bearer $TOLK_TOKEN" "$TOLK_API/jobs/$job" | jq -r '.data.status')
              [ "$state" = "succeeded" ] && break
              [ "$state" = "failed" ] && { echo "The export failed."; exit 1; }
            done
            status=$(fetch)
          fi
          [ "$status" = "200" ] || { echo "Tolk responded $status"; cat export.bin; exit 1; }
          if grep -qi '^content-type: application/zip' headers.txt; then
            unzip -o -q export.bin -d .
          else
            echo "Expected a zip. Choose a profile with multiple languages or files."; exit 1
          fi
          rm -f export.bin headers.txt

      - name: Open pull request
        uses: peter-evans/create-pull-request@v7
        with:
          branch: tolk/translations
          commit-message: 'chore(i18n): update translations from Tolk'
          title: 'chore(i18n): update translations from Tolk'
          body: |
            New translations from Tolk (profile `${{ env.TOLK_PROFILE }}`).
            ${{ github.event.client_payload.locale && format('Trigger: `{0}` is fully translated.', github.event.client_payload.locale) || '' }}
          delete-branch: true

import { createHmac, timingSafeEqual } from 'node:crypto';
import { createServer } from 'node:http';

const { TOLK_WEBHOOK_SECRET, GITHUB_TOKEN, GITHUB_REPOSITORY } = process.env;

function isFromTolk(headers, body) {
  const timestamp = Number(headers['x-tolk-timestamp']);
  const signature = String(headers['x-tolk-signature'] ?? '');
  if (!Number.isInteger(timestamp) || Math.abs(Date.now() / 1000 - timestamp) > 300) {
    return false;
  }
  const expected = 'sha256=' + createHmac('sha256', TOLK_WEBHOOK_SECRET)
    .update(`${timestamp}.${body}`)
    .digest('hex');
  const a = Buffer.from(expected);
  const b = Buffer.from(signature);
  return a.length === b.length && timingSafeEqual(a, b);
}

createServer(async (request, response) => {
  const chunks = [];
  for await (const chunk of request) chunks.push(chunk);
  const body = Buffer.concat(chunks).toString('utf8');

  if (!isFromTolk(request.headers, body)) {
    response.writeHead(401).end();
    return;
  }

  const payload = JSON.parse(body);
  if (payload.event === 'language.completed') {
    await fetch(`https://api.github.com/repos/${GITHUB_REPOSITORY}/dispatches`, {
      method: 'POST',
      headers: {
        Authorization: `Bearer ${GITHUB_TOKEN}`,
        Accept: 'application/vnd.github+json',
        'X-GitHub-Api-Version': '2022-11-28',
      },
      body: JSON.stringify({
        event_type: 'tolk-language-completed',
        client_payload: { project: payload.project.slug, locale: payload.data.language.locale },
      }),
    });
  }

  response.writeHead(204).end();
}).listen(process.env.PORT ?? 8080);