feat(i18n): catalog validation, Phrase hub config, and wire the drift guard into CI

.github/i18n/catalog-validation.json

@@ -0,0 +1,45 @@
+{
+  "version": 1,
+  "tmsConfig": ".github/i18n/phrase-tms.json",
+  "checks": [
+    {
+      "source": {
+        "path": "translations/messages.json",
+        "adapter": "formatjs-json",
+        "locale": "en"
+      },
+      "targets": []
+    }
+  ],
+  "generated": [
+    {
+      "path": "translations/messages.json",
+      "adapter": "formatjs-json",
+      "role": "source",
+      "locale": "en",
+      "command": "npm",
+      "args": [
+        "run",
+        "--silent",
+        "extract:messages",
+        "--",
+        "--out-file",
+        "{output}"
+      ],
+      "updateCommand": "npm run extract:messages"
+    }
+  ],
+  "sourceLint": {
+    "files": [
+      "src/**/*.{js,jsx,ts,tsx}"
+    ]
+  },
+  "catalogDirectories": [
+    {
+      "path": "translations"
+    },
+    {
+      "path": "messages"
+    }
+  ]
+}

.github/i18n/phrase-tms.json

@@ -0,0 +1,8 @@
+{
+  "preset": "hcc-ui",
+  "sourceCatalog": {
+    "path": "translations/messages.json",
+    "filename": "landing-page-frontend.ui.en.json"
+  },
+  "targetOutputPath": "messages/{locale}.json"
+}

.github/workflows/locale-validation.yml

@@ -0,0 +1,26 @@
+name: Validate locale catalogs
+
+on:
+  pull_request:
+    paths:
+      - .github/workflows/locale-validation.yml
+      - .github/i18n/**
+      - translations/**
+      - messages/**
+      - src/**/*.js
+      - src/**/*.jsx
+      - src/**/*.ts
+      - src/**/*.tsx
+      - package.json
+      - package-lock.json
+
+permissions: {}
+
+jobs:
+  validate:
+    uses: RedHatInsights/i18n-tooling/.github/workflows/i18n-validate.yml@7228d32f08872f97c8de8d255b5690e77f484f1f
+    with:
+      package-manager: npm
+      validation-config: .github/i18n/catalog-validation.json
+    permissions:
+      contents: read

.tekton/landing-page-frontend-pull-request.yaml

@@ -35,6 +35,7 @@ spec:
       set -ex
 
       npm run lint
+      npm run lint:translations
       # unit tests only in the container: the storybook project needs browser
       # binaries (playwright) that the hermetic image does not carry
       npm run test:unit

README.md

@@ -82,6 +82,29 @@ npm run test:playwright
 - All tests automatically use this session, eliminating repetitive login steps
 - Cookie prompts are handled by importing `disableCookiePrompt` from the package
 
+## Local i18n validation
+
+The locale-validation workflow builds the i18n CLI, but `npm ci` in this repository does not
+install it. Until `@redhat-cloud-services/i18n-pipeline` is published, build the exact tooling
+revision pinned by `.github/workflows/locale-validation.yml` (currently
+`7228d32f08872f97c8de8d255b5690e77f484f1f`):
+
+```bash
+git clone https://github.com/RedHatInsights/i18n-tooling.git
+cd i18n-tooling
+git checkout 7228d32f08872f97c8de8d255b5690e77f484f1f
+npm ci
+npm run build
+```
+
+Then, from this repository, add that checkout's CLI to `PATH` for the validation command:
+
+```bash
+PATH="/path/to/i18n-tooling/node_modules/.bin:$PATH" npm run translations:validate
+```
+
+This CLI currently requires Node.js 22.14 or newer. If the workflow pin changes, use the new SHA in both the checkout and this instruction.
+
 ## Deployment
 
 The following four branches are used

package.json

@@ -34,7 +34,8 @@
     "storybook": "storybook dev -p 6006",
     "build-storybook": "storybook build",
     "extract:messages": "npx @formatjs/cli extract 'src/**/*.{js,jsx,ts,tsx}' --ignore '**/*.stories.*' --ignore '**/*.test.*' --out-file ./translations/messages.json",
-    "lint:translations": "npm run extract:messages && git diff --exit-code ./translations/messages.json"
+    "lint:translations": "npm run extract:messages && git diff --exit-code ./translations/messages.json",
+    "translations:validate": "i18n-pipeline validate-ci --mode error --config .github/i18n/catalog-validation.json"
   },
   "repository": {
     "type": "git",