From 454e260207ed720a81fc5f382349446acf0cc466 Mon Sep 17 00:00:00 2001
From: Ashley Harrison <ashley.harrison@grafana.com>
Date: Wed, 30 Apr 2025 14:56:21 +0100
Subject: [PATCH] Internationalisation: Use new shared Crowdin token from vault
 (#104764)

* use new shared token now available in vault

* remove )

* use the token

* make changes for create-tasks as well
---
 .github/workflows/i18n-crowdin-create-tasks.yml | 13 +++++++++++++
 .github/workflows/i18n-crowdin-download.yml     | 13 +++++++++++--
 .github/workflows/i18n-crowdin-upload.yml       | 17 +++++++++++++++--
 3 files changed, 39 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/i18n-crowdin-create-tasks.yml b/.github/workflows/i18n-crowdin-create-tasks.yml
index 60277aed365..be4a5c3c270 100644
--- a/.github/workflows/i18n-crowdin-create-tasks.yml
+++ b/.github/workflows/i18n-crowdin-create-tasks.yml
@@ -9,12 +9,25 @@ jobs:
   create-tasks-in-crowdin:
     runs-on: ubuntu-latest
 
+    permissions:
+      contents: read
+      id-token: write # needed to get vault secrets
+
     steps:
       - name: Checkout code
         uses: actions/checkout@v4
         with:
           persist-credentials: false
 
+      - name: "Get vault secrets"
+        id: vault-secrets
+        uses: grafana/shared-workflows/actions/get-vault-secrets@main # zizmor: ignore[unpinned-uses]
+        with:
+          # Vault secret paths:
+          # - ci/repo/grafana/grafana/grafana_frontend_platform_crowdin_bot
+          repo_secrets: |
+            CROWDIN_TOKEN=grafana_frontend_platform_crowdin_bot:access_token
+
       - name: Setup Node.js
         uses: actions/setup-node@v4
         with:
diff --git a/.github/workflows/i18n-crowdin-download.yml b/.github/workflows/i18n-crowdin-download.yml
index 26f9588069f..e019dfc5a43 100644
--- a/.github/workflows/i18n-crowdin-download.yml
+++ b/.github/workflows/i18n-crowdin-download.yml
@@ -28,6 +28,15 @@ jobs:
           token: ${{ steps.generate_token.outputs.token }}
           persist-credentials: false
 
+      - name: "Get vault secrets"
+        id: vault-secrets
+        uses: grafana/shared-workflows/actions/get-vault-secrets@main # zizmor: ignore[unpinned-uses]
+        with:
+          # Vault secret paths:
+          # - ci/repo/grafana/grafana/grafana_frontend_platform_crowdin_bot
+          repo_secrets: |
+            CROWDIN_TOKEN=grafana_frontend_platform_crowdin_bot:access_token
+
       - name: Download sources
         id: crowdin-download
         uses: crowdin/github-action@b8012bd5491b8aa8578b73ab5b5f5e7c94aaa6e2
@@ -58,8 +67,8 @@ jobs:
           github_user_email: "41898282+github-actions[bot]@users.noreply.github.com"
         env:
           GITHUB_TOKEN: ${{ steps.generate_token.outputs.token }}
-          CROWDIN_PROJECT_ID: ${{ secrets.CROWDIN_PROJECT_ID }}
-          CROWDIN_PERSONAL_TOKEN: ${{ secrets.CROWDIN_PERSONAL_TOKEN }}
+          CROWDIN_PROJECT_ID: 5
+          CROWDIN_PERSONAL_TOKEN: ${{ env.CROWDIN_TOKEN }}
 
       - name: Get pull request ID
         if: steps.crowdin-download.outputs.pull_request_url
diff --git a/.github/workflows/i18n-crowdin-upload.yml b/.github/workflows/i18n-crowdin-upload.yml
index 7165aa823fa..6099e323196 100644
--- a/.github/workflows/i18n-crowdin-upload.yml
+++ b/.github/workflows/i18n-crowdin-upload.yml
@@ -12,12 +12,25 @@ jobs:
   upload-sources-to-crowdin:
     runs-on: ubuntu-latest
 
+    permissions:
+      contents: read
+      id-token: write # needed to get vault secrets
+
     steps:
       - name: Checkout
         uses: actions/checkout@v4
         with:
           persist-credentials: false
 
+      - name: "Get vault secrets"
+        id: vault-secrets
+        uses: grafana/shared-workflows/actions/get-vault-secrets@main # zizmor: ignore[unpinned-uses]
+        with:
+          # Vault secret paths:
+          # - ci/repo/grafana/grafana/grafana_frontend_platform_crowdin_bot
+          repo_secrets: |
+            CROWDIN_TOKEN=grafana_frontend_platform_crowdin_bot:access_token
+
       - name: Upload sources
         uses: crowdin/github-action@b8012bd5491b8aa8578b73ab5b5f5e7c94aaa6e2
         with:
@@ -31,5 +44,5 @@ jobs:
           source: 'public/locales/en-US/grafana.json'
           translation: 'public/locales/%locale%/%original_file_name%'
         env:
-          CROWDIN_PROJECT_ID: ${{ secrets.CROWDIN_PROJECT_ID }}
-          CROWDIN_PERSONAL_TOKEN: ${{ secrets.CROWDIN_PERSONAL_TOKEN }}
+          CROWDIN_PROJECT_ID: 5
+          CROWDIN_PERSONAL_TOKEN: ${{ env.CROWDIN_TOKEN }}