No plugin to install and no bot to authorise. GitLab already runs commands on merge; two of them keep your translations in step.
Everything below authenticates with one API key, scoped to read or write and optionally pinned to a single platform, so a build job can never reach further than the app it builds.
GET /status reports how far every locale has got. Fail the job when the language you promised is not finished, and an untranslated string cannot reach production by accident.
Store the key as a masked CI/CD variable. Pin it to one platform in locoloop and a leaked runner log still reaches nothing else.
pull answers 304 Not Modified against an ETag, so a scheduled pipeline that finds no news costs nothing.
The file comes back as that platform's own format — JSON, strings.xml, .po, .arb, XLIFF.
Create a workspace, mint a read/write key, paste the job in. Free while you are evaluating.