菜单
Fix coderabbit review findings on a Crowdin translation PR (l10n_main), keeping Crowdin and the PR branch in sync. Takes an optional PR number, defaults to the open "🌐 New Crowdin updates" PR.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
| name | fix-crowdin-pr |
| description | Fix coderabbit review findings on a Crowdin translation PR (l10n_main), keeping Crowdin and the PR branch in sync. Takes an optional PR number, defaults to the open "🌐 New Crowdin updates" PR. |
Fix coderabbit findings on a Crowdin sync PR so the fix survives the next sync.
Crowdin force pushes l10n_main on every sync. A fix that lands only on the PR branch gets overwritten; a fix made only in Crowdin waits for the next sync. Therefore: upload corrections to Crowdin first, then push the identical changes to the branch. The next sync then exports identical content and the branch stays stable.
Token and project id live in the macOS Keychain:
security find-generic-password -s rallly-billing.CROWDIN_PERSONAL_TOKEN -w
security find-generic-password -s rallly-billing.CROWDIN_PROJECT_ID -w
The token is the secret: retrieve it inline, never echo it. The project id is not secret — it is 527308 and appears in API paths below. Files are namespaced under Crowdin branch main (branchId 10).
Default to the open PR titled "🌐 New Crowdin updates" (gh pr list --search "🌐 New Crowdin updates" --state open), or use the PR number given as an argument.
gh api repos/lukevella/rallly/pulls/<PR>/comments --paginate
Filter to comments authored by coderabbitai. Extract path, line, and the suggested fix from each body.
Check out l10n_main in the session worktree.
Judge each finding on its merits — coderabbit is sometimes wrong. Skip anything that contradicts the English source in apps/web/public/locales/en/, packages/emails/locales/en/, or apps/landing/public/locales/en/, and note why.
Apply accepted fixes with a python script using exact string replacement:
json.load every touched file to prove it still parses.Derive the affected languages from the touched file paths (the locale directory segment), then upload.
Primary: Crowdin CLI (works since preserve_hierarchy: true landed in crowdin.yml, PR #2717). One run per affected language:
CROWDIN_PERSONAL_TOKEN=$(security find-generic-password -s rallly-billing.CROWDIN_PERSONAL_TOKEN -w) \
CROWDIN_PROJECT_ID=$(security find-generic-password -s rallly-billing.CROWDIN_PROJECT_ID -w) \
npx -y @crowdin/cli@4 upload translations -b main -l <crowdin-lang-id> --auto-approve-imported --no-progress
The CLI uploads all translation files for the language, not just touched ones; identical translations are skipped by default, so this is harmless. Do not run crowdin status — the token scopes don't cover it.
Fallback: REST API — use when the CLI fails or Java/npx is unavailable (it is faster and uploads only touched files, but needs hand-rolled requests). Per touched file and language:
POST https://api.crowdin.com/api/v2/storages with headers Authorization: Bearer <token>, Crowdin-API-FileName: <basename>, Content-Type: application/octet-stream, body = raw file bytes. Response gives storageId.
POST https://api.crowdin.com/api/v2/projects/527308/translations/<crowdin-lang-id> with JSON body:
{"storageId": <id>, "fileId": <fileId>, "importEqSuggestions": false, "autoApproveImported": true}
Known fileIds: web app.json = 35, emails emails.json = 68, landing blog.json = 53, common.json = 55, home.json = 57, pricing.json = 59. If a fileId is unknown, list via GET /api/v2/projects/527308/files.
Confirm at least one fix landed as the current translation:
GET /api/v2/projects/527308/languages/<crowdin-lang-id>/translations?stringIds=<ids>&fileId=<fileId>
Find stringIds via GET /api/v2/projects/527308/strings?fileId=<fileId>&filter=<key>&scope=identifier.
Do not use GET /api/v2/projects/527308/translations?stringId=... for verification — it lists suggestions oldest first and ignores orderBy, so it shows stale entries.
Commit to l10n_main with a 🌐 gitmoji message and push. --no-verify is acceptable in a fresh worktree (husky needs node_modules).
Crowdin syncs keep adding new translations, and each sync can bring new coderabbit comments. Unresolved threads must mean "not yet addressed" — so after pushing, reply to every finding and resolve its thread, applied or skipped:
Reply to a review comment (comment ids come from the step 1 fetch):
gh api -X POST repos/lukevella/rallly/pulls/<PR>/comments/<comment-id>/replies -f body='...'
Resolving needs GraphQL — list thread ids, then resolve the ones still open (coderabbit auto-resolves some threads when it sees the fix commit; skip those):
gh api graphql -f query='query { repository(owner: "lukevella", name: "rallly") { pullRequest(number: <PR>) { reviewThreads(first: 50) { nodes { id isResolved comments(first: 1) { nodes { databaseId } } } } } } }'
gh api graphql -f query='mutation { resolveReviewThread(input: {threadId: "<thread-id>"}) { thread { isResolved } } }'
Summarize: findings applied, findings skipped and why, Crowdin verification result, pushed commit sha, and confirmation that all threads are replied to and resolved.
Repo locale dirs use two letter codes (%two_letters_code% in crowdin.yml) plus pt-BR and zh-Hant. Crowdin language ids differ for some:
| Repo dir | Crowdin id |
|---|---|
| es | es-ES |
| sv | sv-SE |
| zh | zh-CN |
| pt-BR | pt-BR |
Everything else observed so far matches the two letter code. If unsure, check targetLanguageIds via GET /api/v2/projects/527308 — an upload to a wrong language id fails loudly, so a mistake here can't corrupt data, only waste a round trip.
subprocess + security, not from shell functions wrapping curl.This skill provides guidance for implementing security features that span across Better Auth, including rate limiting, CSRF protection, session security, trusted origins, secret management, OAuth security, IP tracking, and security auditing. These topics are not covered in individual plugin skills.
Skill for creating auth layers in TypeScript/JavaScript apps using Better Auth.
This skill provides guidance and enforcement rules for implementing secure email and password authentication using Better Auth.
This skill provides guidance and enforcement rules for implementing multi-tenant organizations, teams, and role-based access control using Better Auth's organization plugin.
This skill provides guidance and enforcement rules for implementing secure two-factor authentication (2FA) using Better Auth's twoFactor plugin.
Devmoji commit message emoji conventions. Use when writing git commit messages, formatting commit descriptions, or choosing the right emoji prefix for a commit. Triggers on "commit message", "git commit", "commit emoji", "devmoji".