Weblate: Support GitHub pull requests without the need of a fork

[fnune]

It seems like the default way the GitHub integration system works is by creating a fork of the source repository, then pushing branches to it, then making pull requests from those branches to the master remote.

This introduces some difficulties when working with a continuous integration setup, since then the CI runs will need to be configured to both allow building forked branches and potentially even need to allow sharing credentials/secrets with the forked branch.

See CircleCI for example:

Transcription of the CircleCI options

Build forked pull requests Run builds for pull requests from forks. CircleCI will automatically update the commit status shown on GitHub's pull request page. --- Pass secrets to builds from forked pull requests Run builds for fork pull request changes with this project's configuration, environment variables, and secrets. There are serious security concerns with this setting (see the documentation for details.) If you have SSH keys, sensitive env vars or AWS credentials stored in your project settings and untrusted forks can make pull requests against your repo, then this option isn't for you!

Solution

Would it be possible to change the way the GitHub integration system works? Since Weblate can ask for write permissions, another option would be to:

1. Create a local branch for translations that's automatically rebased onto the source branch.
2. On a Weblate push, make a pull request from this branch to the source branch. Both should be on the master remote.

Then there would be no need for a fork.

Alternative

The alternative right now is to allow forks of private repos, and to then configure CI to allow building forks, and potentially (depending on each setup) to pass credentials to the forks.

Additional context

Weblate version 3.11.3

---

Want to back this issue? Post a bounty on it! We accept bounties via Bountysource.

[nijel]

Right now the GitHub integration is pretty limited and I don't think we can easily support this. There is a plan to rewrite this to give us better flexibility and it should be possible then. See #3493

[github-actions[bot]]

This issue has been added to backlog. It is not scheduled on our road map, but it might be eventually implemented. In case you desperately need this feature, please consider helping or funding the development.

[fnune]

Awesome, thanks!

My assumption was that since Weblate has access to everything I have access to on my terminal (ssh keys to my private repo, hub configured to act on the private repo), then Weblate could potentially also create pull requests the way I do (local branch but same remote as source repo, PR using that remote).

BTW Weblate is great, and is gonna help our org tons :+1:

[nijel]

It is probably possible. But there are several problems with using hub and I don't want to spend time on extending it when there is a plan to replace it.

[fnune]

Of course, makes sense. Thank you! :)

[nijel]

It might be possible to implement easier by setting branch to push (see https://github.com/WeblateOrg/weblate/issues/3610) and skipping forking in that case. That should be easy to implement and would be compatible with existing setups.

[fnune]

Yeap, I suppose then the complexity lies in the possibility of merge conflicts. Unless the branch is compared with the "parent" branch and then reset hard to its state.

Just off the top of my head, though.

[github-actions[bot]]

Thank you for your report, the issue you have reported has just been fixed.

• In case you see a problem with the fix, please comment on this issue.
• In case you see a similar problem, please open a separate issue.
• If you are happy with the outcome, consider supporting Weblate by donating.