[dependabot]

Bumps crowdin/github-action from 2.17.1 to 3.0.0.

Release notes

Sourced from crowdin/github-action's releases.

v3.0.0

Crowdin GitHub Action v3 runs on Crowdin CLI 5 🚀 - a complete rewrite that starts instantly and no longer requires Java. Your workflows, crowdin.yml configuration, and exit codes stay the same, so most setups upgrade with a one-line change:

-uses: crowdin/github-action@v2
+uses: crowdin/github-action@v3

Breaking changes

Only relevant if you pass custom CLI arguments via the command, command_args, or other *_args inputs:

• pre-translate is now auto-translate (no alias); --translate-untranslated-only was removed - use --scope.
• --plain was removed - use --output plain.
• Redundant negatable flags were removed (e.g. --auto-update; --no-auto-update stays) - defaults are unchanged, simply drop them.

v3.0.0-next.3

No release notes provided.

v3.0.0-next.2

No release notes provided.

v3.0.0-next.1

No release notes provided.

v3.0.0-next.0

What's Changed

• CLI v5.0.0-next.3 by @​andrii-bodnar

📖 Read more about the new CLI and share feedback - crowdin/crowdin-cli#1043

Commits

• e4a6c13 feat: v3 release (#315)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[semgrep-code-wireapp]

Semgrep identified an issue in your code:

The workflow runs crowdin/github-action@v3.0.0, a mutable tag, with repository and Crowdin credentials. If the tag is repointed, a scheduled or staging run could execute attacker-controlled code that steals tokens or creates malicious translation changes.

More details about this

crowdin/github-action@v3.0.0 uses a mutable version tag rather than an immutable commit. The Crowdin action runs with ${{secrets.WEBTEAM_CROWDIN_TOKEN}}, ${{github.token}}, and permission to create a pull request and push translation changes, so a maintainer—or an attacker who compromises the crowdin/github-action repository—could repoint v3.0.0 to a malicious commit without changing this workflow.

A plausible attack would be:

1. An attacker gains control of the crowdin/github-action repository or its release tag and moves v3.0.0 to malicious code.
2. The scheduled job or a push to staging runs the Download translations step and executes that code on ubuntu-latest.
3. The malicious action reads secrets.WEBTEAM_CROWDIN_TOKEN and the workflow's ${{github.token}}, then exfiltrates them or uses the token to alter repository contents and create a convincing translations pull request.
4. The pull request can contain attacker-controlled translation files or other changes, potentially leading maintainers or downstream automation to execute or merge the injected content.

To resolve this comment:

✨ Commit fix suggestion

Suggested change

	uses: crowdin/github-action@v3.0.0
	uses: crowdin/github-action@<VERIFIED_VALUE_REQUIRED> # v3.0.0; replace with the verified 40-character commit SHA

View step-by-step instructions

1. Resolve the trusted 40-character commit SHA for crowdin/github-action version v3.0.0 from the action’s official release or repository.
2. Replace the mutable tag with that commit SHA: uses: crowdin/github-action@<40-character-commit-sha>.
3. Add the version as a comment so the pinned dependency remains identifiable, for example: uses: crowdin/github-action@<40-character-commit-sha> # v3.0.0.

💬 Ignore this finding

Reply with Semgrep commands to ignore this finding.

• /fp <comment> for false positive
• /ar <comment> for acceptable risk
• /other <comment> for all other reasons

Alternatively, triage in Semgrep AppSec Platform to ignore the finding created by github-actions-mutable-action-tag.

_{You can view more details about this finding in the Semgrep AppSec Platform.}

[dependabot]

Superseded by #6389.