build(deps): Bump crowdin/github-action from 2.16.3 to 2.16.4

[dependabot]

Bumps crowdin/github-action from 2.16.3 to 2.16.4.

Release notes

Sourced from crowdin/github-action's releases.

v2.16.4

What's Changed

• fix: support non-RSA GPG signing keys by @​oiahoon in crowdin/github-action#313
• CLI 4.14.4 by @​andrii-bodnar

New Contributors

• @​oiahoon made their first contribution in crowdin/github-action#313

Full Changelog: crowdin/github-action@v2.16.3...v2.16.4

Commits

• e0c8f73 chore: CLI 4.14.4
• 6545830 fix: support non-RSA GPG signing keys (#313)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

---

Note

Low Risk
Patch-level GitHub Actions dependency bump in localization workflows only; no application or runtime code changes.

Overview
Bumps crowdin/github-action from v2.16.3 to v2.16.4 in the Crowdin CI workflows.

crowdin-pull.yml and crowdin-push.yml now pin the newer action version. Upstream adds support for non-RSA GPG signing keys and bundles Crowdin CLI 4.14.4; the pull workflow already uses GPG commit signing alongside the Crowdin action, so the signing fix may matter if keys are not RSA.

^{Reviewed by Cursor Bugbot for commit f0dae02. Bugbot is set up for automated code reviews on this repo. Configure here.}

[github-actions]

🤖 Cursor Dependency Analysis

Supply-Chain Malware Review

I'll review the upstream diff and changed files for supply-chain compromise indicators.Checking the changed lines for hidden unicode and verifying commit authorship.Verdict: benign

Patch bump 2.16.3 → 2.16.4 of crowdin/github-action with a 2-line upstream diff that matches the release notes.

Evidence

• Dockerfile: only crowdin/cli:4.14.3 → 4.14.4 (expected CLI pin).
• entrypoint.sh: GPG key-id parsing fixed from RSA-only grep to --with-colons/awk (non-RSA signing support; no network/exfil/persistence).
• Scanner: 0 unicode / confusable / IOC findings. Heuristics are noise — pre-existing apk/exec su-exec shell usage and routine maintainer_drift on a Dependabot bump, not new malicious behavior.
• No lockfile/transitive deps, no lifecycle scripts, no unexpected hosts, no workflow payload beyond the version pin in this repo’s Crowdin workflows.

Compatibility Analysis

I'll inspect local Crowdin action usage and the upstream 2.16.3→2.16.4 diff to assess compatibility.## Compatibility verdict: merge

Patch bump with no action input/API changes. Local workflows stay compatible.

1) Local usage

Only two workflow call sites:

File	Role	Inputs that matter
.github/workflows/crowdin-pull.yml	Download translations + open PR	download_translations, create_pull_request, gpg_private_key / gpg_passphrase (RSA secret name)
.github/workflows/crowdin-push.yml	Upload sources	upload_sources only (no GPG)

2) Intersection with upstream changes

Upstream v2.16.3…v2.16.4 touches only Dockerfile and entrypoint.sh — action.yml unchanged.

Change	Hits this repo?
GPG key-id parsing: RSA-only grep → --with-colons/awk	Yes on pull (signing enabled). Behavior for RSA keys should be equivalent; also unblocks non-RSA if you ever switch.
CLI pin 4.14.3 → 4.14.4	Yes (both workflows). CLI notes are upload/ignore/delete-obsolete fixes — no breaking action API. Push uses upload_sources; pull downloads + PR.

3) Risks / unknowns

• Low: opaque Crowdin CLI patch (no action contract change).
• Negligible for your RSA GPG path; new parser is more correct, not a new feature you must adopt.
• No workflow input renames/removals to migrate.

4) Recommendation

merge — safe patch; no adoption work.

---

Malware Scan Summary

• Status: warn
• Warn only mode: true
• Changed upstream files scanned: 2
• Resolution strategy: tag_range
• Changed node/vendor paths: 0
• Changed lockfiles: 0
• Resolved upstream range: 52aa776766211d83d975df51f3b9c53c2f8ba35f..e0c8f73cdc0fafde9396e056c5038217000a32d1
• Resolved refs: from=52aa776766211d83d975df51f3b9c53c2f8ba35f to=e0c8f73cdc0fafde9396e056c5038217000a32d1
• Unicode findings (post-allowlist): 0
• Confusable findings (post-allowlist): 0
• IOC findings (post-allowlist): 0
• Heuristic findings (post-allowlist): 3

Top findings

• Dockerfile:3 shell_process_spawn :: RUN apk --no-cache add curl git git-lfs jq gnupg su-exec;
• entrypoint.sh:9 shell_process_spawn :: exec su-exec "$TARGET_USER" "$0" "$@"
• crowdin/github-action:0 maintainer_drift :: 2.16.3->2.16.4