State
check-translation-ownership.mjs landed in #65 and runs on every PR, but it currently reports and passes without enforcing anything:
⚠ TRANSLATION_BOT_LOGIN is not set — ownership is not enforced yet.
This PR touches 256 translation artifact(s) and 6 other file(s).
That was deliberate — the check had to land before the account existed, or it could never land at all. But a gate that cannot go red is indistinguishable from a gate that is working, and the only record of this one being switched off is the body of a merged PR. Hence this card.
Until the variable is set, both halves of the split are unenforced: a content PR can still hand-edit six locale siblings, and a translation PR can still edit English sources or site code.
Completion condition
Create the dedicated translation account (suggested login objectos-translator; profile should identify it as a bot, since its PRs are visible to outside contributors).
Add it to this repository only, as an outside collaborator with Write — not as an organization member and not via a team. Organization membership can inherit default repository access, and the org contains the private cloud repository. A translation account has no reason to be able to read the control-plane source, EE pricing, or unreleased roadmap.
Do not give it merge rights, do not add it to CODEOWNERS, and do not add it to any branch-protection bypass list. Its PRs need a human approval like anyone else's.
Set the repository variable TRANSLATION_BOT_LOGIN to that login (Settings → Secrets and variables → Actions → Variables). A variable, not a secret — the login is not sensitive and it must be readable by the workflow on fork PRs.
Verify enforcement is actually on, in both directions, rather than assuming:
- a PR from any other account touching a
*.<locale>.mdx file fails; - a PR from the translation account touching an English
.mdxfails.
Step 5 is the point of the card. Steps 1–4 can all be done and leave the check silently passing if the login is misspelled — and a misspelled login and an unset variable produce different messages, so read the check output rather than the settings page.
Note
No credential is involved. The translation account authenticates locally (gh auth login) in whatever session runs the periodic pass; no token is stored in this repository. Setting this variable does not change that — this repository still holds no secret beyond the two Cloudflare deploy values.
Blocked-on
Nothing technical — this is a maintainer action. See also objectstack-ai/objectstack#9551 for which seat owns work in this repository.
State
check-translation-ownership.mjslanded in #65 and runs on every PR, but it currently reports and passes without enforcing anything:That was deliberate — the check had to land before the account existed, or it could never land at all. But a gate that cannot go red is indistinguishable from a gate that is working, and the only record of this one being switched off is the body of a merged PR. Hence this card.
Until the variable is set, both halves of the split are unenforced: a content PR can still hand-edit six locale siblings, and a translation PR can still edit English sources or site code.
Completion condition
Create the dedicated translation account (suggested login
objectos-translator; profile should identify it as a bot, since its PRs are visible to outside contributors).Add it to this repository only, as an outside collaborator with
Write— not as an organization member and not via a team. Organization membership can inherit default repository access, and the org contains the privatecloudrepository. A translation account has no reason to be able to read the control-plane source, EE pricing, or unreleased roadmap.Do not give it merge rights, do not add it to
CODEOWNERS, and do not add it to any branch-protection bypass list. Its PRs need a human approval like anyone else's.Set the repository variable
TRANSLATION_BOT_LOGINto that login (Settings → Secrets and variables → Actions → Variables). A variable, not a secret — the login is not sensitive and it must be readable by the workflow on fork PRs.Verify enforcement is actually on, in both directions, rather than assuming:
*.<locale>.mdxfile fails;.mdxfails.Step 5 is the point of the card. Steps 1–4 can all be done and leave the check silently passing if the login is misspelled — and a misspelled login and an unset variable produce different messages, so read the check output rather than the settings page.
Note
No credential is involved. The translation account authenticates locally (
gh auth login) in whatever session runs the periodic pass; no token is stored in this repository. Setting this variable does not change that — this repository still holds no secret beyond the two Cloudflare deploy values.Blocked-on
Nothing technical — this is a maintainer action. See also objectstack-ai/objectstack#9551 for which seat owns work in this repository.