ci: gate cacti.pot updates on i18n diff instead of regenerating

[TheWitness]

What

Replaces the Verify translation template is up to date CI step. It no longer
regenerates locales/po/cacti.pot with locales/build_gettext.sh and compares
it (ignoring POT-Creation-Date). Instead it inspects the pull request diff and
requires that locales/po/cacti.pot be part of the PR whenever the translatable
strings actually change.

Why

The old check coupled CI to an exact gettext/xgettext toolchain: a different
GNU gettext version reorders or re-wraps the template and the step fails even
when no translatable string changed. The real intent is simply "if you changed
i18n strings, regenerate and commit the template".

How

New script tests/bin/check-i18n-pot.php:

• Diffs the branch against the PR base SHA (same approach as
  tests/bin/patch-coverage.php).
• Flags a change when any added/removed line contains one of the Cacti i18n
  calls that build_gettext.sh feeds to xgettext
  (__ __n __x __xn __esc __esc_n __esc_x __esc_xn __date __gettext), limited to
  the files that feed the template (find . -maxdepth 2 -name '*.php').
• A pure re-indent or move of an existing i18n line is not treated as a
  change (the added/removed i18n lines are compared as sets).
• If i18n strings changed and locales/po/cacti.pot is not in the PR, the
  step fails with the list of offending files; otherwise it passes.

The step now runs on pull_request events only.

Testing

Validated locally against real branch diffs: adding an __() call without a pot
update fails; adding it with the pot update passes; a non-i18n change passes; a
pure re-indent of an i18n line passes; deleting a template-feeding PHP file that
contained __() without a pot update fails.

[Copilot]

Copilot review overview

🔵 Needs a closer look

The validator has false-negative and false-positive cases that make the CI gate unreliable.

Review effort: Balanced
Findings: None

What changed in this PR

Replaces toolchain-dependent POT regeneration with PR-diff-based i18n validation.

Changes:

• Adds a PHP script to detect changed translation calls.
• Updates CI to run it on pull requests.

File	Description
tests/​bin/​check-i18n-pot.php	Implements diff-based POT validation.
.github/​workflows/​plugin-ci-workflow.yml	Invokes the validator for pull requests.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[TheWitness]

Addressed the automated review's "false-negative and false-positive" concern in tests/bin/check-i18n-pot.php (commit 080e064).

Root cause

The first version scanned the unified diff line-by-line and compared whole normalised lines containing an i18n call. That is both too loose and too strict. I reproduced both failure modes against real branch diffs:

• False positive — changing only unrelated code on a line that also holds an i18n call (e.g. html_start_box(__('New Report', 'reportit'), '60%' ...) → '70%') demanded a cacti.pot update even though the translatable string never changed.
• False negative — a multi-line call whose literal sits on its own line:

  $x = __(
      'Original string',   // change this line only
      'reportit'
  );

  was missed, because the changed line does not itself contain __(.

Fix

The check no longer looks at diff lines. For the merge-base and for HEAD it tokenizes every template-feeding PHP file (the same find . -maxdepth 2 -name '*.php' set build_gettext.sh scans), finds the Cacti i18n helper calls, and collects the literal string arguments that actually form each pot entry — msgctxt/msgid/plural per the xgettext -k spec (__ __n:1,2 __x:1c,2 __xn:1c,2,3 __esc …). A call only contributes when those positions are constant strings, mirroring what xgettext can extract. If the extracted set differs between base and HEAD, locales/po/cacti.pot must be part of the PR.

Because it reads whole files via the tokenizer rather than diff lines:

• surrounding-code edits next to an i18n call no longer trigger it (no false positive),
• multi-line calls are handled correctly (no false negative),
• a pure re-indent or a quote-style-only change ('x' ↔ "x") is not treated as a string change, and
• method calls / declarations ($o->__(), C::__(), function __) are excluded.

Validation — ran a scenario matrix locally against real commits, all passing:

Scenario	Expected	Result
surrounding-code change only	no pot required	PASS
multi-line literal change	pot required	PASS
add new __(), no pot	fail	PASS
add new __() with pot	pass	PASS
non-i18n change	pass	PASS
pure re-indent of i18n line	pass	PASS
delete file containing __(), no pot	fail	PASS
quote-style-only change	pass	PASS

php -l clean on the pushed blob.

[Copilot]

Copilot review overview

🟡 Changes recommended

The new gate has false positives and can incorrectly accept deletion of the POT file.

Review effort: Balanced
Findings: 1

Open (1)

• Document CI gate change in CHANGELOG · New