@chesterbrains/translify-cli 0.8.1 → 0.8.2
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +12 -8
- package/dist/version.js +1 -1
- package/package.json +1 -1
package/README.md
CHANGED
|
@@ -343,7 +343,8 @@ afterwards; the sender waits 10 seconds.
|
|
|
343
343
|
`addedCount`, `changedCount` and `removedCount` are the batch's diff against the previous live batch: a first publish
|
|
344
344
|
has everything in `addedCount`; an `UNPUBLISH` has `publishedCount: 0` and everything that went offline in
|
|
345
345
|
`removedCount`. "Did anything change" is the sum of the three. `withheldCount` is what a `requireApproved` gate kept
|
|
346
|
-
back, `errorCount` the cells
|
|
346
|
+
back, `errorCount` the cells that went live with placeholder errors (a publish with `--allow-errors` or the app's
|
|
347
|
+
"publish anyway", or a rollback, which skips the gate). `actor.type` is `user`, `apiKey`
|
|
347
348
|
(a CLI publish; `name` is the key's name) or `system`. A `ping` carries `id`, `event`, `createdAt`, `project` and
|
|
348
349
|
`webhook { id, target, destination }` only.
|
|
349
350
|
|
|
@@ -359,8 +360,9 @@ Generic webhooks `POST` the payload as `application/json` to an `https://` URL o
|
|
|
359
360
|
| `X-Translify-Signature` | `v1=<hex hmac-sha256(secret, "<timestamp>.<body>")>` |
|
|
360
361
|
| `User-Agent` | `translify-webhooks/1` |
|
|
361
362
|
|
|
362
|
-
The signing secret
|
|
363
|
-
time and refuse a timestamp more than 300 s (5 minutes) away
|
|
363
|
+
The signing secret is shown once when the webhook is created: a generated `whsec_…`, or the 16 to 255 characters you
|
|
364
|
+
supplied. Verify over the raw body, compare in constant time and refuse a timestamp more than 300 s (5 minutes) away
|
|
365
|
+
from now:
|
|
364
366
|
|
|
365
367
|
```js
|
|
366
368
|
import { createHmac, timingSafeEqual } from 'node:crypto';
|
|
@@ -389,11 +391,13 @@ refuses a token or repository GitHub rejects; the expiry GitHub reports is shown
|
|
|
389
391
|
[`recipes/github-actions/translify-pull-on-publish.yml`](https://github.com/chesterbrains/translify-cli/blob/main/recipes/github-actions/translify-pull-on-publish.yml)
|
|
390
392
|
is the workflow that closes the loop: on `translify.publication` it runs `translify pull --from env:<slug>` for the
|
|
391
393
|
environment in the payload, commits, opens a pull request whose body carries the publish summary (batch, counts,
|
|
392
|
-
actor), runs
|
|
393
|
-
to create and approve pull requests** (Settings → Actions → General; without it the job token cannot
|
|
394
|
-
|
|
395
|
-
in Translify
|
|
396
|
-
|
|
394
|
+
actor), runs the build step you add and merges. Three things to set after copying it: the repository setting **Allow
|
|
395
|
+
GitHub Actions to create and approve pull requests** (Settings → Actions → General; without it the job token cannot
|
|
396
|
+
open the PR); the environment the repository follows, a literal in the job's `if:`, with the webhook limited to that
|
|
397
|
+
environment in Translify since every environment pulls into the same files; and your build in the commented Build
|
|
398
|
+
step, so a pull that does not compile leaves the pull request open instead of merging. The workflow builds and merges
|
|
399
|
+
inside the same run because a pull request opened with `GITHUB_TOKEN` never triggers other workflows; a protected
|
|
400
|
+
default branch needs the Merge step removed or a bypass for the token. The
|
|
397
401
|
[translify-examples](https://github.com/chesterbrains/translify-examples/blob/main/.github/workflows/translify-pull-on-publish.yml)
|
|
398
402
|
repository runs this workflow against the demo project.
|
|
399
403
|
|
package/dist/version.js
CHANGED