feat!: convert to a node24 JavaScript action - #322

Closes #321. Also addresses #160 (non-Linux/arm64 runners) and #284 (root-owned files).

This replaces the Docker container action (Dockerfile + entrypoint.sh) with a TypeScript action that runs on node24. The bundled output is in dist/index.js. All existing inputs and outputs are kept, so it can be released as a drop-in v4.

Changes

• Installing the CLI: the action downloads the native Crowdin CLI binary for the runner from the @crowdin/cli-<platform> npm package. It checks the download against the registry's sha512 integrity hash and caches it with @actions/tool-cache. glibc and musl Linux builds are cached separately. Three new optional inputs:
  • cli_version: defaults to 5.5.0, the same version the old Dockerfile used. Exact versions and dist-tags such as latest are accepted.
  • use_installed_cli: use a crowdin already on PATH instead of downloading.
  • npm_registry_url: download from an npm mirror instead of the public registry.
• Port of entrypoint.sh: the shell script is rewritten in TypeScript using @actions/core and @actions/exec. Pull requests, labels, assignees and reviewers now go through Octokit instead of curl and jq. Branch handling, restoring the original checkout and GPG signing behave as before.
• No global state on the runner: the commit name, email and signing key are passed to the commit command with git -c. The GPG key is imported into a temporary GNUPGHOME, which is deleted afterwards. This matters on self-hosted runners, where the old global git config changes would persist.
• user input: deprecated and has no effect, because files are now created by the runner user.
• CI: unit tests (vitest) and a check that dist/ is up to date. The action itself is run on ubuntu-latest, ubuntu-24.04-arm, macos-latest, macos-15-intel and windows-latest. v4 is added to update-main-version.yml.
• Docs: the README has a "Upgrading to v4" section and documents the CLI installation options. CONTRIBUTING.md has development instructions.

Behavior changes (why this is a breaking release)

• The action runs on the runner itself, not in a container. git must be available on the runner, and gpg only when gpg_private_key is set.
• Arguments in command, command_args and *_args are split the way a shell would, so --label "a b" is passed as one argument. Before, the quotes were passed through literally.
• pull_request_url no longer has surrounding double quotes. This was a bug in the old script.
• If adding labels, assignees or reviewers fails, the action logs a warning and continues. The old script ignored these errors silently.

Testing

• npm run typecheck, npm test (37 tests) and npm run build pass locally.
• The git tests run against a real local repository and bare remote. One of them creates a signed commit with a freshly generated GPG key.
• I ran the bundled dist/index.js locally on macOS arm64. Downloading, verifying and caching the CLI, reusing the cached copy, cli_version: latest, use_installed_cli and the command_output output all worked.

Notes for maintainers

• I left the @v3 references in the README and docs unchanged; switching them to @v4 is a release decision.
• dist/ is committed and marked as linguist-generated.

_{🤖 Generated by Claude Opus 5.5 (claude-opus-5.5)}