chore: Bump crowdin/github-action from 2.17.1 to 3.0.2

[dependabot]

Bumps crowdin/github-action from 2.17.1 to 3.0.2.

Release notes

Sourced from crowdin/github-action's releases.

v3.0.2

What's Changed

• CLI 5.0.2 by @​andrii-bodnar

Full Changelog: crowdin/github-action@v3.0.1...v3.0.2

v3.0.1

What's Changed

• CLI 5.0.1 by @​andrii-bodnar

Full Changelog: crowdin/github-action@v3.0.0...v3.0.1

v3.0.0

Crowdin GitHub Action v3 runs on Crowdin CLI 5 🚀 - a complete rewrite that starts instantly and no longer requires Java. Your workflows, crowdin.yml configuration, and exit codes stay the same, so most setups upgrade with a one-line change:

-uses: crowdin/github-action@v2
+uses: crowdin/github-action@v3

Breaking changes

Only relevant if you pass custom CLI arguments via the command, command_args, or other *_args inputs:

• pre-translate is now auto-translate (no alias); --translate-untranslated-only was removed - use --scope.
• --plain was removed - use --output plain.
• Redundant negatable flags were removed (e.g. --auto-update; --no-auto-update stays) - defaults are unchanged, simply drop them.

v3.0.0-next.3

No release notes provided.

v3.0.0-next.2

No release notes provided.

v3.0.0-next.1

No release notes provided.

v3.0.0-next.0

What's Changed

• CLI v5.0.0-next.3 by @​andrii-bodnar

📖 Read more about the new CLI and share feedback - crowdin/crowdin-cli#1043

Commits

• 0d5670f chore: CLI 5.0.2
• 71fdb88 chore: CLI 5.0.1
• 06edd94 docs: update the v3 announcement
• 64eab86 ci: support v3 in update-main-version workflow
• e4a6c13 feat: v3 release (#315)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[semgrep-code-wireapp]

Semgrep identified an issue in your code:

The translation workflow runs crowdin/github-action@v3.0.2, whose tag can be silently repointed to attacker-controlled code. A later scheduled or staging-triggered run could expose WEBTEAM_CROWDIN_TOKEN and GITHUB_TOKEN or create a malicious pull request.

More details about this

crowdin/github-action@v3.0.2 uses a mutable Git reference. The owner of crowdin/github-action can silently move the v3.0.2 tag to a new commit, so a future run of the scheduled Download translations job or a push to staging could execute attacker-controlled action code.

A plausible attack is:

1. An attacker compromises the Crowdin action repository or its release process and repoints the v3.0.2 tag.
2. The next workflow run starts the Download translations step and executes the new code without any change to this repository.
3. That code can read secrets.WEBTEAM_CROWDIN_TOKEN and the workflow's GITHUB_TOKEN, then use those credentials to access Crowdin, modify repository contents, or create a malicious pull request because this job enables create_pull_request: true.
4. The malicious action can also alter the translation files or exfiltrate credentials before the workflow completes, making the compromise appear to be a normal translation update.

To resolve this comment:

✨ Commit fix suggestion

Suggested change

	uses: crowdin/github-action@v3.0.2
	uses: crowdin/github-action@<VERIFIED_VALUE_REQUIRED> # v3.0.2

View step-by-step instructions

1. Resolve the exact commit SHA for crowdin/github-action release v3.0.2 from the action’s trusted release history.
2. Replace the mutable version tag with that 40-character SHA and keep the version as a comment, for example: uses: crowdin/github-action@<40-character-commit-sha> # v3.0.2
3. Pin the actions/checkout@v6 step to its corresponding full 40-character commit SHA as well, using the same format. A commit SHA cannot be silently repointed, unlike a tag or branch.

💬 Ignore this finding

Reply with Semgrep commands to ignore this finding.

• /fp <comment> for false positive
• /ar <comment> for acceptable risk
• /other <comment> for all other reasons

Alternatively, triage in Semgrep AppSec Platform to ignore the finding created by github-actions-mutable-action-tag.

_{You can view more details about this finding in the Semgrep AppSec Platform.}