fix: sign Lingo translation commits

[h4rkl]

Summary

• import a GPG signing key before Lingo translation PR jobs run
• enable Lingo's GPG signing path for both UI and docs translation commits
• pin the GPG import action to the current v7 commit SHA

Testing

• pnpm -w exec prettier --ignore-path .prettierignore --check .github/workflows/i18n.yml

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
solana-com	Ready	Preview, Comment	Jun 23, 2026 12:57am
solana-com-accelerate	Ready	Preview, Comment	Jun 23, 2026 12:57am
solana-com-breakpoint-2	Ready	Preview, Comment	Jun 23, 2026 12:57am
solana-com-docs	Ready	Preview, Comment	Jun 23, 2026 12:57am
solana-com-media	Ready	Preview, Comment	Jun 23, 2026 12:57am
templates	Ready	Preview, Comment	Jun 23, 2026 12:57am

[greptile-apps]

Greptile Summary

This PR adds GPG commit signing to both i18n translation jobs (i18n-ui and i18n-docs) in the Lingo workflow and simultaneously pins lingodotdev/lingo.dev from the mutable @main ref to a specific commit SHA.

• Inserts crazy-max/ghaction-import-gpg (pinned to a commit SHA) before each Lingo step to import a private GPG key and configure git commit.gpgsign.
• Passes the GPG key's derived name/email as LINGODOTDEV_COMMIT_AUTHOR_NAME/LINGODOTDEV_COMMIT_AUTHOR_EMAIL env vars and sets LINGODOTDEV_GPG_SIGN: "true" to enable signing inside the Lingo action.
• Pins lingodotdev/lingo.dev to commit SHA a4664c984ca4caba4346f8e81e5823c0cda57789, closing the previous supply-chain concern raised in review.

Confidence Score: 5/5

Safe to merge — the change adds GPG signing infrastructure and pins a previously mutable action ref to a specific commit SHA.

Both third-party actions are pinned to immutable commit SHAs, the GPG import is correctly ordered before the Lingo step in both jobs, and env vars are passed consistently across i18n-ui and i18n-docs.

No files require special attention.

Important Files Changed

Filename	Overview
.github/workflows/i18n.yml	Adds GPG signing steps to both i18n jobs and pins lingo.dev action to a commit SHA; changes are symmetric, correctly structured, and close prior supply-chain concerns.

Sequence Diagram

%%{init: {'theme': 'neutral'}}%%
sequenceDiagram
    participant GH as GitHub Actions Runner
    participant GPG as ghaction-import-gpg (SHA-pinned)
    participant Lingo as lingodotdev/lingo.dev (SHA-pinned)
    participant Repo as GitHub Repository

    GH->>GPG: Import LINGODOTDEV_GPG_PRIVATE_KEY + PASSPHRASE
    GPG-->>GH: "outputs.name, outputs.email, git config (signingkey + gpgsign=true)"
    GH->>Lingo: "GH_TOKEN, LINGODOTDEV_COMMIT_AUTHOR_NAME, LINGODOTDEV_COMMIT_AUTHOR_EMAIL, LINGODOTDEV_GPG_SIGN=true"
    Lingo->>Repo: GPG-signed commit + pull request

Loading

%%{init: {'theme': 'base', 'themeVariables': {"darkMode": true, "background": "#0d1117", "primaryColor": "#21262d", "primaryTextColor": "#e6edf3", "primaryBorderColor": "#8b949e", "lineColor": "#8b949e", "textColor": "#e6edf3", "edgeLabelBackground": "#161b22", "actorBkg": "#21262d", "actorBorder": "#8b949e", "actorTextColor": "#e6edf3", "actorLineColor": "#8b949e", "signalColor": "#8b949e", "signalTextColor": "#e6edf3", "noteBkgColor": "#373320", "noteBorderColor": "#d4a72c", "noteTextColor": "#f0e6c0", "labelBoxBkgColor": "#21262d", "labelBoxBorderColor": "#8b949e", "labelTextColor": "#e6edf3", "loopTextColor": "#e6edf3", "activationBkgColor": "#30363d", "activationBorderColor": "#8b949e"}}}%%
sequenceDiagram
    participant GH as GitHub Actions Runner
    participant GPG as ghaction-import-gpg (SHA-pinned)
    participant Lingo as lingodotdev/lingo.dev (SHA-pinned)
    participant Repo as GitHub Repository

    GH->>GPG: Import LINGODOTDEV_GPG_PRIVATE_KEY + PASSPHRASE
    GPG-->>GH: "outputs.name, outputs.email, git config (signingkey + gpgsign=true)"
    GH->>Lingo: "GH_TOKEN, LINGODOTDEV_COMMIT_AUTHOR_NAME, LINGODOTDEV_COMMIT_AUTHOR_EMAIL, LINGODOTDEV_GPG_SIGN=true"
    Lingo->>Repo: GPG-signed commit + pull request

Loading

_{Reviews (2): Last reviewed commit: "fix: pin Lingo action for signed commits" | Re-trigger Greptile}