Fix various GHA workflow bugs

.github/workflows/check-icla.yml

@@ -1,16 +1,14 @@
-name: Check ICLA
+name: Check » ICLA
 on:
   pull_request_target:
     types:
       - opened
 
 jobs:
-  main:
+  check-icla:
     if: github.event.pull_request.user.login != 'dependabot[bot]'
     runs-on: ubuntu-24.04
     steps:
-      - uses: actions/setup-python@v5
-
       - name: Install Python module
         run: pip install --break-system-packages apereocla
 

.github/workflows/check-label.yml

@@ -1,23 +1,38 @@
 # This workflow runs on any change made to a pull-request and aims to verify
 # that the correct label is present.
 
-name: Check proper label usage
+name: Check » Proper label usage
 
 on:
   pull_request_target:
     types: [opened, labeled, unlabeled, synchronize]
 
 jobs:
-  labels:
+  check-labels:
     runs-on: ubuntu-latest
     steps:
       # Ensure that one of the required labels is present and none of the undesired is absent
       # See https://github.com/jesusvasquez333/verify-pr-label-action
       - name: Verify PR label action
         uses: jesusvasquez333/verify-pr-label-action@v1.4.0
         with:
-          github-token: '${{ secrets.GITHUB_TOKEN }}'
-          valid-labels: 'type:tests, type:infrastructure, type:enhancement, type:feature, type:dependencies, type:documentation, type:accessibility, type:security, type:bug, type:usability, type:visual-clarity, type:code-quality'
-          invalid-labels: 'status:duplicate, status:conflicts, status:wontfix'
-          pull-request-number: '${{ github.event.pull_request.number }}'
+          github-token: "${{ secrets.GITHUB_TOKEN }}"
+          valid-labels: >
+            type:tests,
+            type:infrastructure,
+            type:enhancement,
+            type:feature,
+            type:dependencies,
+            type:documentation,
+            type:accessibility,
+            type:security,
+            type:bug,
+            type:usability,
+            type:visual-clarity,
+            type:code-quality
+          invalid-labels: >
+            status:duplicate,
+            status:conflicts,
+            status:wontfix
+          pull-request-number: "${{ github.event.pull_request.number }}"
           disable-reviews: true

.github/workflows/check-merge-conflict.yml

@@ -1,4 +1,4 @@
-name: Merge conflict check
+name: Check » Merge conflicts
 on:
   push:
   pull_request_target:
@@ -7,7 +7,7 @@ on:
       - synchronize
 
 jobs:
-  main:
+  check-merge-conflicts:
     runs-on: ubuntu-latest
     steps:
       - name: Check for dirty pull requests

.github/workflows/crowdin-download-translations.yml

@@ -6,37 +6,37 @@ on:
   workflow_dispatch:
 
 jobs:
-  update-translations:
+  download-translations:
     if: github.repository_owner == 'opencast'
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
 
-      - name: prepare git
+      - name: Prepare git
         run: |
-          git config --global user.email 'crowdin-bot@editor.opencast.org'
+          git config --global user.email 'crowdin-bot@opencast.org'
           git config --global user.name 'Crowdin Bot'
 
-      - name: prepare crowdin client
+      - name: Prepare crowdin client
         run: |
           wget --quiet https://artifacts.crowdin.com/repo/deb/crowdin3.deb -O crowdin.deb
           sudo dpkg -i crowdin.deb
 
-      - name: download translations
+      - name: Download translations
         env:
           CROWDIN_TOKEN: ${{ secrets.CROWDIN_TOKEN }}
         run: |
           crowdin download --config .crowdin.yaml -b main
 
-      - name: update language list
+      - name: Update language list
         working-directory: src/i18n/locales
         run: $GITHUB_WORKSPACE/.github/generate-lngs.sh > ../lngs-generated.ts
 
-      - name: add new translations
+      - name: Add new translations
         run: |
           git add src/i18n/
 
-      - name: upload translations
+      - name: Upload translations
         run: |
           if git commit -m "Automatically update translation keys"; then
             git push

.github/workflows/crowdin-upload-keys.yml

@@ -7,23 +7,23 @@ on:
       - r/*
 
 concurrency:
-  group: crowdin
+  group: crowdin-${{ github.ref }}
   cancel-in-progress: true
 
 jobs:
-  deploy-translation-keys:
+  upload-translation-keys:
     if: github.repository_owner == 'opencast'
     runs-on: ubuntu-latest
     steps:
     - uses: actions/checkout@v4
 
-    - name: prepare crowdin client
+    - name: Prepare crowdin client
       run: |
-        wget --quiet https://artifacts.crowdin.com/repo/deb/crowdin3.deb -O crowdin.deb
-        sudo dpkg -i crowdin.deb
+        wget --quiet https://artifacts.crowdin.com/repo/deb/crowdin3.deb
+        sudo dpkg -i crowdin3.deb
 
-    - name: upload translation source
+    - name: Upload translation source
       env:
         CROWDIN_TOKEN: ${{ secrets.CROWDIN_TOKEN }}
       run: |
-        crowdin upload sources --config .crowdin.yaml -b main
+        crowdin upload sources --config .crowdin.yaml -b "${GITHUB_REF##*/}"

.github/workflows/update.yml → .github/workflows/deploy-main-branches.yml

@@ -1,4 +1,4 @@
-name: Build & Deploy main branches
+name: Build » Deploy main branches
 
 on:
   push:
@@ -11,7 +11,7 @@ concurrency:
   cancel-in-progress: false
 
 jobs:
-  detect:
+  detect-repo-owner:
     if: github.repository_owner == 'opencast'
     runs-on: ubuntu-latest
     outputs:
@@ -23,7 +23,7 @@ jobs:
 
       - name: Determine the correct test server
         id: test-server
-        run: echo "server=`./.github/get-release-server.sh ${{ github.ref_name }}`" >> $GITHUB_OUTPUT
+        run: echo "server=https://`./.github/get-release-server.sh ${{ github.ref_name }}`" >> $GITHUB_OUTPUT
 
       - name: Determine branch name
         id: branch-name
@@ -33,29 +33,29 @@ jobs:
           #Strip the r/ prefix, giving us just 17.x.  If this is main/develop this does nothing
           echo "branch=${TEMP#r\/}" >> $GITHUB_OUTPUT
 
-  main:
+  deploy-main-branches:
     runs-on: ubuntu-latest
-    needs: detect
+    needs: detect-repo-owner
     steps:
       - name: Checkout sources
         uses: actions/checkout@v4
 
-      - name: Use Node.js
+      - name: Get Node.js
         uses: actions/setup-node@v4
         with:
           node-version: 20
 
-      - name: Clean install
+      - name: Run npm ci
         run: npm ci
 
-      - name: Build App
+      - name: Build the app
         run: |
           # This set the editor's datasource to the relevant test server
           sed -i "s#develop.opencast.org#$SERVER#g" public/editor-settings.toml
           npm run build
         env:
-          SERVER: ${{needs.detect.outputs.server}}
-          PUBLIC_URL: ${{needs.detect.outputs.branch}}
+          SERVER: ${{needs.detect-repo-owner.outputs.server}}
+          PUBLIC_URL: ${{needs.detect-repo-owner.outputs.branch}}
           VITE_APP_SETTINGS_PATH: editor-settings.toml
 
       # tests are currently failing
@@ -65,7 +65,7 @@ jobs:
 
       - name: Prepare git
         run: |
-          git config --global user.name "Release Bot"
+          git config --global user.name "Editor Deployment Bot"
           git config --global user.email "cloud@opencast.org"
 
       - name: Commit new version
@@ -86,7 +86,7 @@ jobs:
           git add $BRANCH index.html
           git diff --staged --quiet || git commit --amend -m "Build $(date)"
         env:
-          BRANCH: ${{needs.detect.outputs.branch}}
+          BRANCH: ${{needs.detect-repo-owner.outputs.branch}}
 
       - name: Push updates
         run: git push origin gh-pages --force

.github/workflows/update-test.yml → .github/workflows/pr-deploy-test-branch.yml

@@ -1,4 +1,4 @@
-name: Publish Pull Request Page
+name: PRs » Publish Pull Request Page
 
 on:
   pull_request_target:
@@ -11,10 +11,8 @@ concurrency:
   cancel-in-progress: false
 
 jobs:
-  detect:
-    needs: member
-    if: ${{ needs.member.outputs.is_team_member == 'true'
-      || github.event.pull_request.head.repo.full_name == 'opencast/opencast-editor' }}
+  detect-repo-owner:
+    if: github.repository_owner == 'opencast'
     runs-on: ubuntu-latest
     outputs:
       server: ${{ steps.test-server.outputs.server }}
@@ -28,7 +26,7 @@ jobs:
 
       - name: Determine the correct test server
         id: test-server
-        run: echo "server=`./.github/get-release-server.sh ${{ github.ref_name }}`" >> $GITHUB_OUTPUT
+        run: echo "server=https://`./.github/get-release-server.sh ${{ github.ref_name }}`" >> $GITHUB_OUTPUT
 
       - name: Determine branch name
         id: branch-name
@@ -38,43 +36,43 @@ jobs:
           #Strip the r/ prefix, giving us just 17.x.  If this is main/develop this does nothing
           echo "branch=${TEMP#r\/}" >> $GITHUB_OUTPUT
 
-  main:
+  deploy-pr:
     runs-on: ubuntu-latest
-    needs: detect
+    needs: detect-repo-owner
     steps:
-      - name: generate build path
+      - name: Generate build path
         run: echo "build=${{github.event.number}}/$(date +%Y-%m-%d_%H-%M-%S)/" >> $GITHUB_OUTPUT
         id: build-path
 
-      - name: Checkout Sources
+      - name: Checkout sources
         uses: actions/checkout@v4
         with:
           ref: ${{github.event.pull_request.head.ref}}
           repository: ${{github.event.pull_request.head.repo.full_name}}
 
-      - name: Use Node.js
+      - name: Get Node.js
         uses: actions/setup-node@v4
         with:
           node-version: 20
 
-      - name: Clean install
+      - name: Run npm ci
         run: npm ci
 
-      - name: Build App
+      - name: Build the app
         run: |
           # This set the editor's datasource to the relevant test server
           sed -i "s#develop.opencast.org#$SERVER#g" public/editor-settings.toml
           npm run build
         env:
-          SERVER: ${{needs.detect.outputs.server}}
+          SERVER: ${{needs.detect-repo-owner.outputs.server}}
           PUBLIC_URL: ${{ steps.build-path.outputs.build }}
 
-      - name: Prepare Git
+      - name: Prepare git
         run: |
-          git config --global user.name "Release Bot"
+          git config --global user.name "Editor Deployment Bot"
           git config --global user.email "cloud@opencast.org"
 
-      - name: Prepare GitHub SSH key
+      - name: Prepare GitHub SSH key from org level secret
         env:
           DEPLOY_KEY: ${{ secrets.DEPLOY_KEY_TEST }}
         run: |
@@ -94,7 +92,7 @@ jobs:
         run: |
           git clone -b gh-pages "git@github.com:${{ github.repository_owner }}/opencast-editor-test.git" editor-test
 
-      - name: Store build
+      - name: Store build in the clone
         env:
           DEPLOY_PATH: editor-test/${{ steps.build-path.outputs.build }}
         run: |
@@ -134,6 +132,7 @@ jobs:
       - name: Add comment with deployment location
         uses: thollander/actions-comment-pull-request@v3
         with:
+          comment-tag: static-test-deployment
           message: >
             This pull request is deployed at
             [test.editor.opencast.org/${{ steps.build-path.outputs.build }}
@@ -142,7 +141,10 @@ jobs:
             It might take a few minutes for it to become available.
 
 
-  member:
+  #This is currently defunct, but kept around in case we run into issues in the future
+  # where this check might be handy, cf spammers filing PRs or something.
+  # Previously we checked is_team_member prior to doing anything else above
+  check-member:
     name: Check organization membership
     if: github.repository_owner == 'opencast'
     runs-on: ubuntu-latest
@@ -173,7 +175,7 @@ jobs:
           exit: false
 
 
-  translations:
+  check-no-modified-translations:
     name: Translations only via Crowdin
     if: github.repository_owner == 'opencast'
     runs-on: ubuntu-latest