docs: fix documentation accuracy issues and add performance baseline

[konradmichalik]

Summary

• Backfill CHANGELOG entries for the 20 security-fix and performance PRs merged into main that were missing release notes
• Correct default-validator documentation (KeyNamingConventionValidator is now opt-in, same as DuplicateValuesValidator)
• Fix the CLI reference's JSON output example, which described a schema that doesn't match ValidationResultJsonRenderer at all
• Fix the CLI reference's GitHub Actions output example to include the summary annotation and line/col/title params, and document exit-code behavior under --strict
• Fix the programmatic usage example, which called methods that don't exist on ValidationResult/Issue (hasErrors(), getIssues(), getFilePath())
• Align validator console-output examples with the actual renderer message text (KeyCountValidator, KeyNamingConventionValidator, PlaceholderConsistencyValidator) and fix a missing -d tests flag in a copy-pasteable example
• Document XLIFF 2.0 schema support and the target-language consistency check, previously only XLIFF 1.2 was mentioned
• Add PERFORMANCE.md with a before/after benchmark comparing main prior to and after the 22 merged PRs (~25% faster, ~12.5% less peak memory)

Changes

• CHANGELOG.md - Add missing entries for merged fix/perf PRs
• docs/configuration/schema.md - Correct skip option default value
• docs/index.md - Mark KeyNamingConventionValidator as opt-in
• docs/reference/cli.md - Rewrite JSON/GitHub output examples, document --only/--skip validation errors and --strict exit-code behavior
• docs/reference/programmatic-usage.md - Replace broken example with the actual ValidationResult API
• docs/reference/validators.md - Fix console-output wording and test commands
• docs/reference/file-formats.md - Document XLIFF 2.0 support
• PERFORMANCE.md - New before/after performance report

Summary by CodeRabbit

• Performance

  • Faster validation with reduced rendering and file-collection overhead.
  • Improved caching, deduplication, and bounded memory usage.

• Security & Bug Fixes

  • Hardened XLIFF and PHP translation parsing.
  • Added protections against oversized files, terminal injection, unsafe paths, symlinks, and invalid validator selections.
  • Improved XLIFF language and schema validation.

• Documentation

  • Updated CLI behavior, output formats, exit codes, configuration defaults, validator examples, and programmatic usage guidance.
  • Added benchmark methodology and performance results.

[coderabbitai]

📝 Walkthrough

Walkthrough

This PR adds a benchmark methodology and results document, expands the Unreleased changelog, and updates documentation for CLI behavior, output formats, programmatic usage, configuration defaults, XLIFF support, and validator examples.

Changes

Documentation and benchmark updates

Layer / File(s)	Summary
Benchmark record and release notes PERFORMANCE.md, CHANGELOG.md	Documents the validation benchmark methodology, baseline and after measurements, merged changes, and new performance and security changelog entries.
CLI and programmatic result contracts docs/reference/cli.md, docs/reference/programmatic-usage.md	Documents validator-selection failures, exit-code behavior, updated JSON and GitHub output, nested issue handling, and programmatic exit-code resolution.
Validation configuration and reference examples docs/configuration/schema.md, docs/index.md, docs/reference/file-formats.md, docs/reference/validators.md	Updates validator defaults, validator listings, XLIFF feature documentation, command examples, and validator output wording.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

• move-elevator/composer-translation-validator#2: Related to XLIFF content resolution and validation behavior documented here.
• move-elevator/composer-translation-validator#30: Related to the documented PlaceholderConsistencyValidator output.
• move-elevator/composer-translation-validator#57: Related to the validation orchestration benchmark and output behavior described here.

Suggested reviewers: km@move-elevator.de

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately summarizes the doc fixes and the new performance baseline added in this changeset.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feature/docs-accuracy-fixes

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 3

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@docs/configuration/schema.md`:
- Around line 59-60: Clarify the configuration documentation for the default
skip list and the interaction between validators: [] and skip: []. Update the
relevant validators and skip descriptions to state whether an omitted skip list
still excludes the documented default validators, and that an explicit empty
skip list enables every available validator.

In `@docs/reference/cli.md`:
- Around line 190-194: Update the fenced output block in the CLI documentation
to include an appropriate language identifier, such as text or console, while
preserving its displayed validation messages.

In `@PERFORMANCE.md`:
- Around line 17-18: Update the benchmark documentation’s Runs description to
explicitly state that memory_get_peak_usage(true) reports the process-level
high-water mark across all five back-to-back runs, since gc_collect_cycles()
does not reset it. Do not describe the value as an independent per-run peak
unless the benchmark is changed to isolate or reset measurements.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: aaff29be-e83a-46cd-b6b9-f0b12b7ded07

📥 Commits

Reviewing files that changed from the base of the PR and between f4d1610 and 1b42337.

📒 Files selected for processing (8)

• CHANGELOG.md
• PERFORMANCE.md
• docs/configuration/schema.md
• docs/index.md
• docs/reference/cli.md
• docs/reference/file-formats.md
• docs/reference/programmatic-usage.md
• docs/reference/validators.md