fix: add least-privilege GITHUB_TOKEN permissions to workflows (#3080) #5128

	name: Upload Crowdin files

	# on any push to main, we upload the translations to be translated
	on:
	push:
	branches:
	- main

	# Crowdin sync authenticates with BOT_TOKEN, so GITHUB_TOKEN only needs read.
	permissions:
	contents: read

	jobs:
	upload-to-crowdin:
	name: Upload sources to Crowdin
	runs-on: ubuntu-latest

	steps:
	- name: Checkout
	uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1

	- uses: pnpm/action-setup@a7487c7e89a18df4991f7f222e4898a00d66ddda # v4.1.0

	- uses: actions/setup-node@395ad3262231945c25e8478fd5baf05154b1d79f # v6.1.0
	with:
	node-version-file: '.nvmrc'
	cache: 'pnpm'

	- name: Synchronize
	uses: crowdin/github-action@60debf382ee245b21794321190ad0501db89d8c1 # v2.13.0
	with:
	upload_sources: true
	download_translations: false
	config: 'crowdin.yml'
	env:
	GITHUB_TOKEN: ${{ secrets.BOT_TOKEN }}
	CROWDIN_PERSONAL_TOKEN: ${{ secrets.CROWDIN_TOKEN }}

Navigation Menu