From 1510c42ac9eae1f63089eb6c58f722a1ef27b631 Mon Sep 17 00:00:00 2001
From: zhom <2717306+zhom@users.noreply.github.com>
Date: Sat, 26 Sep 2026 16:54:42 +0400
Subject: [PATCH] chore: linting

---
 .github/scripts/i18n-review.mjs   | 11 +++++++++--
 .github/workflows/i18n-review.yml |  5 ++++-
 2 files changed, 13 insertions(+), 3 deletions(-)

diff --git a/.github/scripts/i18n-review.mjs b/.github/scripts/i18n-review.mjs
index 52009c4d..fcbc9a42 100644
--- a/.github/scripts/i18n-review.mjs
+++ b/.github/scripts/i18n-review.mjs
@@ -26,7 +26,10 @@ import { appendFileSync, mkdirSync, readFileSync, writeFileSync } from "node:fs"
 import path from "node:path";
 
 const LOCALES_DIR = "src/i18n/locales";
-const OUT = process.env.I18N_REVIEW_DIR || "/tmp/i18n-review";
+// The workflow points this under RUNNER_TEMP, which only this job can reach.
+// A fixed path in the shared /tmp would let another local user plant the
+// files that `report` posts.
+const OUT = process.env.I18N_REVIEW_DIR;
 const API = process.env.GITHUB_API_URL || "https://api.github.com";
 const MARKER = "<!-- donut-translation-review -->";
 // The prompt travels as one 128 KiB argument next to the system prompt.
@@ -153,7 +156,7 @@ async function resolveRefs() {
 }
 
 async function collect() {
-  mkdirSync(OUT, { recursive: true });
+  mkdirSync(OUT, { recursive: true, mode: 0o700 });
   const refs = await resolveRefs();
   if (!refs) return skip("no earlier commit to compare with");
 
@@ -412,4 +415,8 @@ if (!run) {
   console.error("usage: i18n-review.mjs collect|report");
   process.exit(2);
 }
+if (!OUT) {
+  console.error("I18N_REVIEW_DIR must name a private work directory");
+  process.exit(2);
+}
 await run();
diff --git a/.github/workflows/i18n-review.yml b/.github/workflows/i18n-review.yml
index 9ab67aa5..a55fdddf 100644
--- a/.github/workflows/i18n-review.yml
+++ b/.github/workflows/i18n-review.yml
@@ -32,7 +32,6 @@ concurrency:
 env:
   # `auto` lets Copilot pick; see issue-compliance.yml.
   COPILOT_MODEL: auto
-  I18N_REVIEW_DIR: /tmp/i18n-review
 
 jobs:
   review:
@@ -54,6 +53,10 @@ jobs:
           persist-credentials: false
           sparse-checkout: .github
 
+      # RUNNER_TEMP belongs to this job alone; a fixed /tmp path does not.
+      - name: Use a private work directory
+        run: echo "I18N_REVIEW_DIR=$RUNNER_TEMP/i18n-review" >> "$GITHUB_ENV"
+
       - name: Collect changed strings
         id: collect
         env: