From 49a28b357c3212f2502d400a754fe4be48b681e5 Mon Sep 17 00:00:00 2001
From: Michaela <85624192+mkrbr@users.noreply.github.com>
Date: Thu, 11 Jun 2026 13:55:13 +0200
Subject: [PATCH] AAE-46943 Sign Crowdin translation PR commits with GPG
 (#11974)

* AAE-46943 Sign Crowdin translation PR commits with GPG

Add GPG signing and the service-account commit identity to the Crowdin
pull workflow so automated-translations-update commits satisfy the
"Require signed commits" branch protection rule.

* AAE-46943 Pass signing key secret through reusable Crowdin workflow

Declare SERVICE_ACCOUNT_SIGNING_KEY in workflow_call.secrets and pass it
from release.yml so commit signing also works when pull-from-crowdin is
invoked as a reusable workflow.
---
 .github/workflows/pull-from-crowdin.yml | 5 +++++
 .github/workflows/release.yml           | 1 +
 2 files changed, 6 insertions(+)

diff --git a/.github/workflows/pull-from-crowdin.yml b/.github/workflows/pull-from-crowdin.yml
index c8db6bb297..8ffa43ec38 100644
--- a/.github/workflows/pull-from-crowdin.yml
+++ b/.github/workflows/pull-from-crowdin.yml
@@ -9,6 +9,8 @@ on:
         required: true
       CROWDIN_TRANSLATIONS_TOKEN:
         required: true
+      HXP_GIT_COMMIT_SIGNING_PRIVATE_KEY:
+        required: true
 jobs:
   pull-from-crowdin:
     runs-on: ubuntu-latest
@@ -28,6 +30,9 @@ jobs:
           localization_branch_name: automated-translations-update
           pull_request_title: "GH auto: Automated Update of Translations from Crowdin"
           pull_request_base_branch_name: develop
+          github_user_name: ${{ vars.HXP_GIT_USERNAME }}
+          github_user_email: ${{ vars.HXP_GIT_EMAIL }}
+          gpg_private_key: ${{ secrets.HXP_GIT_COMMIT_SIGNING_PRIVATE_KEY }}
         env:
           GITHUB_TOKEN: ${{ secrets.BOT_GITHUB_TOKEN }}
           CROWDIN_TOKEN: ${{ secrets.CROWDIN_TRANSLATIONS_TOKEN }}
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index a6224ace54..2370e1d9d2 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -173,6 +173,7 @@ jobs:
     secrets:
       BOT_GITHUB_TOKEN: ${{ secrets.BOT_GITHUB_TOKEN }}
       CROWDIN_TRANSLATIONS_TOKEN: ${{ secrets.CROWDIN_TRANSLATIONS_TOKEN }}
+      HXP_GIT_COMMIT_SIGNING_PRIVATE_KEY: ${{ secrets.HXP_GIT_COMMIT_SIGNING_PRIVATE_KEY }}
 
   finalize:
     if: always()