🔐 Use PR Submit for translations (#16168)

.github/pr-submit.yml

@@ -1,3 +1,4 @@
 workflows:
   - .github/workflows/bump-pre-commit-hooks.yml
   - .github/workflows/prepare-release.yml
+  - .github/workflows/translate.yml

.github/workflows/translate.yml

@@ -30,11 +30,6 @@ on:
         type: string
         required: false
         default: ""
-      commit_in_place:
-        description: Commit changes directly instead of making a PR
-        type: boolean
-        required: false
-        default: false
       max:
         description: Maximum number of items to translate (e.g. 10)
         type: number
@@ -82,7 +77,8 @@ jobs:
     needs: langs
     runs-on: ubuntu-latest
     permissions:
-      contents: write
+      contents: read
+      id-token: write
     strategy:
       matrix:
         lang: ${{ fromJson(needs.langs.outputs.langs) }}
@@ -95,7 +91,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
-          persist-credentials: true # Required for `git push` in `translate.py`
+          persist-credentials: false
       - name: Set up Python
         uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
@@ -118,17 +114,24 @@ jobs:
         with:
           limit-access-to-actor: true
         env:
-          GITHUB_TOKEN: ${{ secrets.FASTAPI_TRANSLATIONS }} # zizmor: ignore[secrets-outside-env]
+          GITHUB_TOKEN: ${{ github.token }}
           OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }} # zizmor: ignore[secrets-outside-env]
       - name: FastAPI Translate
-        run: |
-          uv run ./scripts/translate.py "$COMMAND"
-          uv run ./scripts/translate.py make-pr
+        run: uv run ./scripts/translate.py "$COMMAND"
         env:
-          GITHUB_TOKEN: ${{ secrets.FASTAPI_TRANSLATIONS }} # zizmor: ignore[secrets-outside-env]
           OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }} # zizmor: ignore[secrets-outside-env]
           LANGUAGE: ${{ matrix.lang }}
           EN_PATH: ${{ github.event.inputs.en_path }}
           COMMAND: ${{ matrix.command }}
-          COMMIT_IN_PLACE: ${{ github.event.inputs.commit_in_place == 'true' && 'true' || '' }}
           MAX: ${{ github.event.inputs.max }}
+      - name: Get PR Submit token
+        id: pr-submit
+        uses: tiangolo/pr-submit@d802fdf59bde80bc3eb8bd3259f4cbeec63de4aa # 0.0.1
+      - name: Create pull request
+        run: |
+          gh auth setup-git
+          uv run ./scripts/translate.py make-pr
+        env:
+          GITHUB_TOKEN: ${{ steps.pr-submit.outputs.token }}
+          LANGUAGE: ${{ matrix.lang }}
+          COMMAND: ${{ matrix.command }}

scripts/translate.py

@@ -421,37 +421,25 @@ def make_pr(
     command: Annotated[str | None, typer.Option(envvar="COMMAND")] = None,
     github_token: Annotated[str, typer.Option(envvar="GITHUB_TOKEN")],
     github_repository: Annotated[str, typer.Option(envvar="GITHUB_REPOSITORY")],
-    commit_in_place: Annotated[
-        bool, typer.Option(envvar="COMMIT_IN_PLACE", show_default=True)
-    ] = False,
 ) -> None:
     print("Setting up GitHub Actions git user")
     repo = git.Repo(Path(__file__).absolute().parent.parent)
     if not repo.is_dirty(untracked_files=True):
         print("Repository is clean, no changes to commit")
         return
-    subprocess.run(["git", "config", "user.name", "github-actions[bot]"], check=True)
+    subprocess.run(["git", "config", "user.name", "pr-submit[bot]"], check=True)
     subprocess.run(
-        ["git", "config", "user.email", "github-actions[bot]@users.noreply.github.com"],
+        ["git", "config", "user.email", "pr-submit[bot]@users.noreply.github.com"],
         check=True,
     )
-    current_branch = repo.active_branch.name
-    if current_branch == "master" and commit_in_place:
-        print("Can't commit directly to master")
-        raise typer.Exit(code=1)
-
-    if not commit_in_place:
-        branch_name = "translate"
-        if language:
-            branch_name += f"-{language}"
-        if command:
-            branch_name += f"-{command}"
-        branch_name += f"-{secrets.token_hex(4)}"
-        print(f"Creating a new branch {branch_name}")
-        subprocess.run(["git", "checkout", "-b", branch_name], check=True)
-    else:
-        branch_name = current_branch
-        print(f"Committing in place on branch {branch_name}")
+    branch_name = "translate"
+    if language:
+        branch_name += f"-{language}"
+    if command:
+        branch_name += f"-{command}"
+    branch_name += f"-{secrets.token_hex(4)}"
+    print(f"Creating a new branch {branch_name}")
+    subprocess.run(["git", "checkout", "-b", branch_name], check=True)
     print("Adding updated files")
     git_path = Path("docs")
     subprocess.run(["git", "add", str(git_path)], check=True)
@@ -464,20 +452,17 @@ def make_pr(
     subprocess.run(["git", "commit", "-m", message], check=True)
     print("Pushing branch")
     subprocess.run(["git", "push", "origin", branch_name], check=True)
-    if not commit_in_place:
-        print("Creating PR")
-        g = Github(github_token)
-        gh_repo = g.get_repo(github_repository)
-        body = (
-            message
-            + "\n\nThis PR was created automatically using LLMs."
-            + f"\n\nIt uses the prompt file https://github.com/fastapi/fastapi/blob/master/docs/{language}/llm-prompt.md."
-            + "\n\nIn most cases, it's better to make PRs updating that file so that the LLM can do a better job generating the translations than suggesting changes in this PR."
-        )
-        pr = gh_repo.create_pull(
-            title=message, body=body, base="master", head=branch_name
-        )
-        print(f"Created PR: {pr.number}")
+    print("Creating PR")
+    g = Github(github_token)
+    gh_repo = g.get_repo(github_repository)
+    body = (
+        message
+        + "\n\nThis PR was created automatically using LLMs."
+        + f"\n\nIt uses the prompt file https://github.com/fastapi/fastapi/blob/master/docs/{language}/llm-prompt.md."
+        + "\n\nIn most cases, it's better to make PRs updating that file so that the LLM can do a better job generating the translations than suggesting changes in this PR."
+    )
+    pr = gh_repo.create_pull(title=message, body=body, base="master", head=branch_name)
+    print(f"Created PR: {pr.number}")
     print("Finished")