The ask was to decouple translations from the release cycle so
community translators don't have to wait on a maintainer to merge
strings. Loading translations from a CDN was offered, but pulling
untrusted JSON into the UI at runtime adds attack surface and breaks
the offline-friendly self-hosted story.
Instead, automate the merge path that already exists:
- New scripts/validate-locales.js checks every public/locales/*.json
for JSON validity, _meta fields, and shape compatibility with
en.json (same key paths, same value types). Missing keys are
warnings (partial translations are OK, English is the fallback).
Also runnable locally with 'npm run validate-locales'.
- New .github/workflows/translations-autovalidate.yml runs that
validator on every PR that touches public/locales/**. If the PR is
translations-only (no en.json, no code) and validation passes,
it labels the PR 'translations-only' and turns on GitHub's
auto-merge so it goes in as soon as required checks are green.
- Workflow runs on pull_request (not pull_request_target) so it
cannot read secrets from fork PRs.
ancsemi