feat(crowdin): allow source string edits and deletes - #21

What

scripts/crowdin_validator.py was an additions-only gate: any PR that edited or deleted an existing string failed, on the policy that Crowdin was the sole origin for those changes. This makes the repo a legitimate origin for all three.

Findings now split in two:

Structural checks are scoped to the files a PR changed, so a pre-existing quirk elsewhere can't fail an unrelated PR.

Deleting strings is allowed; deleting the file that holds them is not. crowdin upload sources can only ever upload a file, so a removed .po survives in Crowdin and the next pull restores it along with every string in it. Emptying a file in place is the same outcome by another route and is caught the same way — but only for a file that had entries to begin with, since licenses.po ships empty. Such a file is reported once rather than as a flood of per-string delete notices.

Renames are detected by pairing a deleted key with an added key carrying identical text, and called out separately: that's the one delta where Crowdin's key matching means translations don't survive.

Two coupled fixes, without which the above would be cosmetic

• crowdin/crowdin.yml gains update_option: update_as_unapproved. These files carry X-Crowdin-SourceKey: msgstr, so editing a msgstr is a source-text change. Crowdin's default would have discarded that string's translations in every language. Validated against the CLI's config parser, with a deliberately-invalid control to confirm the check actually runs.
• crowdin_sync.py warns when a whole .po is deleted. The validator rejects that on the PR, but it skips the sync bot's own branch and only runs on PRs, so the push keeps a backstop.

The # Never pass --delete-obsolete comment was right but for the wrong reason, and is corrected. Per crowdin upload sources --help (CLI 4.12.0) the flag deletes obsolete files and folders, not strings — against our per-file -s invocation it would have deleted the other 29 .po files. Per-string deletion already propagates via the default --auto-update.

Also softened: the cross-file duplicate-key message no longer claims Crowdin rejects them. Crowdin scopes keys per file and tolerates it — 53 such pairs already exist on main (about, back, done, …). It still fails the build because it's almost always a copy-paste slip, but it only ever fires on newly-added keys, so no existing content is affected.

Tests

Adds scripts/test_crowdin_validator.py — the repo's first tests. Stdlib unittest, no new dependencies.

python3 -m unittest discover -s scripts -p 'test_*.py'

36 cases: parsing/detection unit tests, plus end-to-end cases that build a throwaway git repo and assert on exit code and stdout, which is the whole contract Bitrise consumes. Includes merge shapes (delete + edit, two-into-one, cross-file) to pin that a merge is never misread as a rename, and boundary cases for the whole-file rule.

Verification

• 36/36 pass; all four structural checks report zero findings across the 859 real keys in strings/en/.
• Real scratch branch, mixed delta (1 add, 1 edit, 1 delete, 1 rename) → exit 0, all classified correctly. Four deliberate mistakes → exit 1, all four errors fired.
• Removing movies.po (12 strings) + emptying fonts.po (4 strings) → exit 1, both named with counts. Deleting two strings from app.po while keeping the file → exit 0.
• --push --dry-run: correct per-file scoping, no --delete-obsolete, whole-file-delete warning fires.

Reviewer notes

• ⚠️ Branch name deviates from AGENTS.md. The convention is initials/description-TICKET-ID with the ticket last; this branch has no ticket ID, and deltes is a typo for deletes. Flagged here per .claude/rules/branch-naming.md rather than silently renaming, since the name was chosen deliberately. Happy to rename if you'd prefer.
• ⚠️ The live Crowdin round-trip is unverified — push a scratch key, delete it, push again, confirm a pull doesn't resurrect it. That needs the real CROWDIN_API_TOKEN against shared project 257. Everything else was verified offline, but the reconcile-on-upload behaviour relied on for per-string deletes is inferred from the CLI's documented --auto-update, not observed live.
• youversion-flutter-loop/scripts/crowdin_validator.py is a near-identical copy whose validate() was byte-for-byte the same. It still blocks edits and deletes for that repo — separate PR.

Greptile Summary

The PR allows repository-originated source-string additions, edits, and deletions while retaining structural validation and preventing whole-catalog loss.

• Adds reporting and validation for string edits, deletions, renames, malformed entries, empty values, and duplicate keys.
• Rejects deleted, renamed, moved, or emptied catalogs and adds a sync-time warning for deleted files.
• Preserves translations from edited source text as unapproved and adds comprehensive validator tests.

Confidence Score: 5/5

The PR appears safe to merge.

No blocking failure remains.

Important Files Changed

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart LR
    A[Repository source-string change] --> B[Catalog validator]
    B -->|Valid string-level change| C[Merge]
    B -->|Structural error or catalog loss| D[Reject PR]
    C --> E[Crowdin source upload]
    E --> F[Updated Crowdin source state]
    F --> G[Future source pull]
    G --> A

_{Reviews (4): Last reviewed commit: "fix(crowdin_validator): reject losing a ..." | Re-trigger Greptile}