release(feat): publish CLI 1.6.0 and the English-only site

.github/workflows/crowdin.yml

@@ -0,0 +1,102 @@
+name: Crowdin translations
+
+on:
+  # Paused until a no-cost automated translation workflow is verified.
+  # Source edits must not create a manual translation maintenance queue.
+  workflow_dispatch:
+    inputs:
+      import_existing:
+        description: 'One-time import of existing repository translations as unapproved suggestions'
+        type: boolean
+        default: false
+
+permissions:
+  contents: write
+  pull-requests: write
+  actions: write
+
+concurrency:
+  group: crowdin-translations
+  cancel-in-progress: false
+
+jobs:
+  synchronize:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10
+        with:
+          version: 10.24.0
+
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: 22
+          cache: pnpm
+
+      - run: pnpm install --frozen-lockfile
+
+      - name: Validate and preserve current translations
+        run: |
+          pnpm i18n:check
+          mkdir -p "$RUNNER_TEMP/crowdin-baseline"
+          cp -R messages "$RUNNER_TEMP/crowdin-baseline/messages"
+
+      - name: Upload English source and optionally bootstrap existing translations
+        uses: crowdin/github-action@8f01d54f70f1713ee3f09d82c2bbb2daeac28689 # v2
+        with:
+          user: auto
+          upload_sources: true
+          upload_translations: ${{ inputs.import_existing || false }}
+          auto_approve_imported: false
+          import_eq_suggestions: false
+          download_translations: false
+          push_translations: false
+          create_pull_request: false
+        env:
+          CROWDIN_PROJECT_ID: ${{ secrets.CROWDIN_PROJECT_ID }}
+          CROWDIN_PERSONAL_TOKEN: ${{ secrets.CROWDIN_PERSONAL_TOKEN }}
+
+      - name: Download translated strings only
+        uses: crowdin/github-action@8f01d54f70f1713ee3f09d82c2bbb2daeac28689 # v2
+        with:
+          user: auto
+          upload_sources: false
+          upload_translations: false
+          download_translations: true
+          skip_untranslated_strings: true
+          push_translations: false
+          create_pull_request: false
+        env:
+          CROWDIN_PROJECT_ID: ${{ secrets.CROWDIN_PROJECT_ID }}
+          CROWDIN_PERSONAL_TOKEN: ${{ secrets.CROWDIN_PERSONAL_TOKEN }}
+
+      - name: Preserve absent translations and reject invalid exports
+        run: |
+          pnpm exec tsx tools/i18n/sync-crowdin.ts "$RUNNER_TEMP/crowdin-baseline"
+          pnpm exec prettier --write messages/locales
+          pnpm i18n:check
+
+      - name: Save validated export for inspection
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: crowdin-validated-export
+          path: messages/locales/*.json
+          retention-days: 7
+
+      - name: Open a reviewable translation PR
+        if: github.ref == 'refs/heads/dev'
+        id: pr
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: bash tools/i18n/publish-crowdin.sh
+
+      # GITHUB_TOKEN-created PRs do not emit another pull_request workflow run.
+      # Dispatch the real release and smoke gates on the translation branch.
+      - name: Run all PR gates on the translation commit
+        if: steps.pr.outputs.pr_number
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: gh workflow run registry-verification.yml --ref codex/crowdin-translations

.github/workflows/package-publish.yml

@@ -21,24 +21,28 @@ jobs:
     steps:
       # The publish job holds NPM_TOKEN, so third-party actions are pinned to a
       # reviewed commit and admitted by that exact ref in the Actions allowlist.
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
+          persist-credentials: false
           ref: main
 
       - name: Fetch candidate release tag
         env:
+          GH_TOKEN: ${{ github.token }}
           RELEASE_TAG: ${{ github.event.release.tag_name }}
         run: |
-          git fetch --force --no-tags origin \
+          git -c credential.helper= \
+            -c credential.helper="!f() { echo username=x-access-token; echo \"password=\$GH_TOKEN\"; }; f" \
+            fetch --force --no-tags origin \
             main:refs/remotes/origin/main \
             "refs/tags/${RELEASE_TAG}:refs/tags/${RELEASE_TAG}"
 
       - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10
         with:
           version: 10.24.0
 
-      - uses: actions/setup-node@v7
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: 22
           cache: pnpm
@@ -94,7 +98,7 @@ jobs:
         env:
           NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
 
-      - uses: actions/setup-node@v7
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: 22
           registry-url: https://npm.pkg.github.com

.github/workflows/registry-verification.yml

@@ -19,23 +19,50 @@ on:
 
 env:
   NEXT_TELEMETRY_DISABLED: '1'
+  I18N_BASE_REF: ${{ github.event.pull_request.base.sha || '' }}
+
+concurrency:
+  group: registry-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
 permissions:
   contents: read
 
 jobs:
+  changes:
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    outputs:
+      consumer: ${{ steps.classify.outputs.consumer || 'true' }}
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - name: Classify pull request changes
+        id: classify
+        if: github.event_name == 'pull_request'
+        env:
+          BASE_SHA: ${{ github.event.pull_request.base.sha }}
+          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
+        run: |
+          git fetch --no-tags --depth=1 origin "$BASE_SHA" "$HEAD_SHA"
+          node tools/ci/classify-changes.mjs
+
   release-gate:
-    if: github.event_name == 'pull_request' || github.event_name == 'push'
+    if: github.event_name == 'pull_request' || github.event_name == 'push' || github.event_name == 'workflow_dispatch'
     runs-on: ubuntu-latest
     timeout-minutes: 60
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+          fetch-depth: 0
 
-      - uses: pnpm/action-setup@v6
+      - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10
         with:
           version: 10.24.0
 
-      - uses: actions/setup-node@v7
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: 22
           cache: pnpm
@@ -54,11 +81,11 @@ jobs:
         shell: bash
         run: |
           set -o pipefail
-          pnpm test:release 2>&1 | tee payload-components-release.log
+          pnpm test:ci 2>&1 | tee payload-components-release.log
 
       - name: Upload failure artifacts
         if: failure()
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: release-gate-artifacts
           path: |
@@ -68,17 +95,21 @@ jobs:
           if-no-files-found: ignore
 
   node-20-compat:
-    if: github.event_name == 'pull_request' || github.event_name == 'push'
+    needs: changes
+    if: needs.changes.outputs.consumer == 'true' && (github.event_name == 'pull_request' || github.event_name == 'push' || github.event_name == 'workflow_dispatch')
     runs-on: ubuntu-latest
     timeout-minutes: 30
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+          fetch-depth: 0
 
-      - uses: pnpm/action-setup@v6
+      - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10
         with:
           version: 10.24.0
 
-      - uses: actions/setup-node@v7
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: 20.19.0
           cache: pnpm
@@ -100,17 +131,20 @@ jobs:
   quick-checks:
     # Fast-fail lint + type-check so common errors surface in ~2 min instead of
     # waiting on the full release gate (which first installs a browser for e2e).
-    if: github.event_name == 'pull_request' || github.event_name == 'push'
+    if: github.event_name == 'pull_request' || github.event_name == 'push' || github.event_name == 'workflow_dispatch'
     runs-on: ubuntu-latest
     timeout-minutes: 20
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+          fetch-depth: 0
 
-      - uses: pnpm/action-setup@v6
+      - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10
         with:
           version: 10.24.0
 
-      - uses: actions/setup-node@v7
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: 22
           cache: pnpm
@@ -126,10 +160,11 @@ jobs:
           pnpm exec tsc --noEmit
 
   pr-gate:
-    if: ${{ always() && (github.event_name == 'pull_request' || github.event_name == 'push') }}
+    if: ${{ always() && (github.event_name == 'pull_request' || github.event_name == 'push' || github.event_name == 'workflow_dispatch') }}
     runs-on: ubuntu-latest
     timeout-minutes: 5
     needs:
+      - changes
       - quick-checks
       - release-gate
       - node-20-compat
@@ -138,22 +173,35 @@ jobs:
       - name: Require every release and smoke gate
         shell: bash
         run: |
-          if [[ "${{ needs.quick-checks.result }}" != "success" || \
-                "${{ needs.release-gate.result }}" != "success" || \
-                "${{ needs.node-20-compat.result }}" != "success" || \
-                "${{ needs.fresh-payload-smoke.result }}" != "success" ]]; then
-            echo "One or more required release gates failed or were skipped."
+          if [[ "${{ needs.changes.result }}" != "success" ||
+                "${{ needs.quick-checks.result }}" != "success" ||
+                "${{ needs.release-gate.result }}" != "success" ]]; then
+            echo "Required checks failed, were cancelled, or were skipped."
             exit 1
           fi
-          echo "All release gates and fresh-consumer shards passed."
+          expected=success
+          if [[ "${{ needs.changes.outputs.consumer }}" == "false" ]]; then expected=skipped; fi
+          if [[ "${{ needs.node-20-compat.result }}" != "$expected" ||
+                "${{ needs.fresh-payload-smoke.result }}" != "$expected" ]]; then
+            echo "Consumer checks did not reach the expected result: $expected"
+            exit 1
+          fi
+          echo "All required checks passed."
 
   fresh-payload-smoke:
+    needs: changes
+    if: needs.changes.outputs.consumer == 'true'
     runs-on: ubuntu-latest
     timeout-minutes: 90
     strategy:
       fail-fast: false
       matrix:
-        shard-index: [0, 1, 2, 3]
+        include:
+          - { scenario: bare, shard-index: 0 }
+          - { scenario: website, shard-index: 0 }
+          - { scenario: website, shard-index: 1 }
+          - { scenario: website, shard-index: 2 }
+          - { scenario: website, shard-index: 3 }
     services:
       postgres:
         image: postgres:16
@@ -169,6 +217,7 @@ jobs:
           --health-timeout 5s
           --health-retries 5
     env:
+      SMOKE_PAYLOAD_VERSION: ${{ github.event_name == 'schedule' && 'latest' || '3.88.0' }}
       CRON_SECRET: ci-cron-secret
       DATABASE_URL: postgresql://postgres:postgres@127.0.0.1:5432/payload_components
       NEXT_PUBLIC_SERVER_URL: http://localhost:3000
@@ -177,13 +226,16 @@ jobs:
       PREVIEW_SECRET: ci-preview-secret
       SMOKE_REGISTRY_URL: ${{ github.event.inputs.registry_url || '' }}
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+          fetch-depth: 0
 
-      - uses: pnpm/action-setup@v6
+      - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10
         with:
           version: 10.24.0
 
-      - uses: actions/setup-node@v7
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: 22
           cache: pnpm
@@ -197,16 +249,18 @@ jobs:
         run: |
           set -o pipefail
           if [ -n "$SMOKE_REGISTRY_URL" ]; then
-            pnpm test:fresh -- --registry-url "$SMOKE_REGISTRY_URL" --shard-index "${{ matrix.shard-index }}" --keep-temp 2>&1 | tee payload-components-fresh.log
+            pnpm test:fresh -- --scenario "${{ matrix.scenario }}" --registry-url "$SMOKE_REGISTRY_URL" --shard-index "${{ matrix.shard-index }}" --keep-temp 2>&1 | tee payload-components-fresh.log
+          elif [ "${{ github.event_name }}" = "schedule" ]; then
+            pnpm test:fresh -- --scenario "${{ matrix.scenario }}" --registry-url 'https://www.payload-components.xyz/r/{name}.json' --shard-index "${{ matrix.shard-index }}" --keep-temp 2>&1 | tee payload-components-fresh.log
           else
-            pnpm test:fresh -- --shard-index "${{ matrix.shard-index }}" --keep-temp 2>&1 | tee payload-components-fresh.log
+            pnpm test:fresh -- --scenario "${{ matrix.scenario }}" --shard-index "${{ matrix.shard-index }}" --keep-temp 2>&1 | tee payload-components-fresh.log
           fi
 
       - name: Upload failure artifacts
         if: failure()
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
-          name: fresh-payload-artifacts-${{ matrix.shard-index }}
+          name: fresh-payload-artifacts-${{ matrix.scenario }}-${{ matrix.shard-index }}
           path: |
             payload-components-fresh.log
             playwright-report