feat(i18n): automated translation pipeline with machine review gate

.github/workflows/i18n-lint.yml

@@ -6,6 +6,7 @@ on:
       - 'i18n/**'
       - 'content/**'
       - 'hack/check-i18n.sh'
+      - 'hack/i18n/**'
       - '.github/workflows/i18n-lint.yml'
   push:
     branches:
@@ -14,6 +15,7 @@ on:
       - 'i18n/**'
       - 'content/**'
       - 'hack/check-i18n.sh'
+      - 'hack/i18n/**'
       - '.github/workflows/i18n-lint.yml'
   workflow_dispatch:
 
@@ -34,3 +36,15 @@ jobs:
           persist-credentials: false
       - name: Check i18n key parity and translation freshness
         run: ./hack/check-i18n.sh
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: '3.x'
+      - name: Run i18n pipeline unit tests
+        # Guards the pure functions of the translation pipeline — including the
+        # ref/relref deref that keeps a partially-translated page from breaking
+        # the Hugo build. Only pyyaml is needed; the Claude SDK is imported lazily
+        # at runtime, not at test-import time.
+        run: |
+          python3 -m pip install --quiet pyyaml
+          python3 hack/i18n/test_i18n.py

.github/workflows/i18n-translate.yml

@@ -0,0 +1,94 @@
+name: i18n translate
+
+# Daily translation run, one weekly PR — the same contract as hack/i18n/run-daily.sh,
+# moved off a maintainer's clone and personal Max subscription onto CI and an
+# ORG-OWNED Anthropic API key (auth: api-key). Nothing reaches production
+# automatically: the run pushes to a weekly branch and opens a PR a maintainer
+# merges. No auto-merge, CODEOWNERS/branch protection untouched.
+#
+# Required secret:
+#   I18N_ANTHROPIC_API_KEY  — an organization-owned Anthropic API key (metered).
+# Optional secret:
+#   I18N_GH_TOKEN           — a PAT/app token used to push the branch and open the
+#                             PR so its checks (i18n-lint, DCO) actually run; the
+#                             default GITHUB_TOKEN cannot trigger them. Without it
+#                             the run still works, but the PR opens with no checks.
+#
+# Until I18N_ANTHROPIC_API_KEY exists the job is a green no-op (see the guard step),
+# so enabling the schedule before provisioning the key does not spam failures.
+
+on:
+  schedule:
+    - cron: '17 3 * * *'   # daily, 03:17 UTC
+  workflow_dispatch:
+    inputs:
+      lang:
+        description: 'Limit to one language code (e.g. ru); empty = all'
+        required: false
+        default: ''
+      limit:
+        description: 'Max pages this run; empty = until the daily quota stops it'
+        required: false
+        default: ''
+
+concurrency:
+  group: i18n-translate
+  cancel-in-progress: false
+
+permissions:
+  contents: write
+  pull-requests: write
+
+jobs:
+  translate:
+    runs-on: ubuntu-latest
+    timeout-minutes: 300
+    env:
+      I18N_AUTH: api-key
+      ANTHROPIC_API_KEY: ${{ secrets.I18N_ANTHROPIC_API_KEY }}
+      GH_TOKEN: ${{ secrets.I18N_GH_TOKEN || github.token }}
+    steps:
+      - name: Guard — org API key provisioned
+        id: guard
+        run: |
+          if [ -z "${ANTHROPIC_API_KEY}" ]; then
+            echo "::notice::secret I18N_ANTHROPIC_API_KEY is not set yet — skipping this run."
+            echo "skip=true" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Checkout
+        if: steps.guard.outputs.skip != 'true'
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+          token: ${{ secrets.I18N_GH_TOKEN || github.token }}
+
+      - name: Fetch all branches (weekly-branch bookkeeping needs origin/i18n/week-*)
+        if: steps.guard.outputs.skip != 'true'
+        run: |
+          git config remote.origin.fetch '+refs/heads/*:refs/remotes/origin/*'
+          git fetch --prune origin
+
+      - name: Set up Python
+        if: steps.guard.outputs.skip != 'true'
+        uses: actions/setup-python@v5
+        with:
+          python-version: '3.12'
+
+      - name: Set up Node
+        if: steps.guard.outputs.skip != 'true'
+        uses: actions/setup-node@v4
+        with:
+          node-version: '22'
+
+      - name: Install Claude CLI (driven by the Agent SDK)
+        if: steps.guard.outputs.skip != 'true'
+        run: npm install -g @anthropic-ai/claude-code
+
+      - name: Run translation pipeline
+        if: steps.guard.outputs.skip != 'true'
+        run: |
+          args=()
+          if [ -n "${{ github.event.inputs.lang }}" ]; then args+=(--lang "${{ github.event.inputs.lang }}"); fi
+          if [ -n "${{ github.event.inputs.limit }}" ]; then args+=(--limit "${{ github.event.inputs.limit }}"); fi
+          hack/i18n/run-daily.sh "${args[@]}"

.gitignore

@@ -27,6 +27,13 @@ static/docs/*/cozystack-api/
 
 # Claude Code local settings
 .claude/
+
+# i18n pipeline venv (bootstrapped by hack/i18n/run-daily.sh)
+.venv-i18n/
+
+# i18n pipeline: per-run artifacts, not content
+hack/i18n/last-run-findings.md
+
 .demo-build-uidir
 
 # demo overlay ships a public/ with the MSW worker — keep it despite the public/ ignore

config/production/hugo.yaml

@@ -72,6 +72,18 @@ module:
       files:
         - '! **/_include/*'
         - '! docs/next/**'
+    - source: content/es
+      target: content
+      lang: es
+      files:
+        - '! **/_include/*'
+        - '! docs/next/**'
+    - source: content/pt-br
+      target: content
+      lang: pt-br
+      files:
+        - '! **/_include/*'
+        - '! docs/next/**'
     - source: node_modules/bootstrap
       target: assets/vendor/bootstrap
     - source: node_modules/@fortawesome/fontawesome-free

content/de/docs/v1.5/getting-started/install-kubernetes.md

@@ -0,0 +1,33 @@
+---
+title: 2. Kubernetes-Cluster installieren und bootstrappen
+linkTitle: 2. Kubernetes installieren
+description: Bootstrappen Sie mit der Talm CLI einen Kubernetes-Cluster, der bereit für Cozystack ist.
+weight: 15
+source_digest: sha256:9624dd07a127efc0d02fb379b7d06aea0c363bf1f85d1e75a1ae8a068663cc9c
+l10n: mt
+translation_review: auto-reviewed
+---
+## Ziele
+
+Wir beginnen diesen Schritt des Tutorials mit [drei Knoten, auf denen Talos Linux installiert ist](/docs/v1.5/getting-started/install-talos/).
+
+Am Ende dieses Schritts haben wir einen Kubernetes-Cluster, der installiert, konfiguriert und bereit für die Installation von Cozystack ist.
+Außerdem verfügen wir über eine `kubeconfig` für diesen Cluster und haben grundlegende Prüfungen des Clusters durchgeführt.
+
+## Kubernetes installieren
+
+Installieren Sie einen Kubernetes-Cluster und führen Sie den Bootstrap durch – mit [Talm](/docs/v1.5/install/kubernetes/talm/), einem deklarativen CLI-Konfigurationswerkzeug mit fertigen Konfigurationsvoreinstellungen für Cozystack.
+
+{{% alert color="info" %}}
+Dieser Teil des Tutorials wird derzeit überarbeitet.
+Er wird eine vereinfachte Anleitung zur Talm-Installation enthalten – ohne all die zusätzlichen Optionen und Sonderfälle, die im Haupt-Talm-Leitfaden behandelt werden.
+{{% /alert %}}
+
+
+## Nächster Schritt
+
+Setzen Sie das Cozystack-Tutorial fort, indem Sie [Cozystack installieren und konfigurieren](/docs/v1.5/getting-started/install-cozystack/).
+
+Zusatzaufgaben:
+
+-   Schauen Sie sich [github.com/cozystack/talm](https://github.com/cozystack/talm) an und vergeben Sie einen Stern!

hack/i18n/.gitignore

@@ -0,0 +1,4 @@
+__pycache__/
+*.pyc
+# venv bootstrapped by run-daily.sh (repo root); listed here too for safety
+.venv-i18n/