The L10n bot change https://gerrit.wikimedia.org/r/c/mediawiki/extensions/CentralAuth/+/1012929 had to be manually merged because the message translation included something that looks like XML tags. CI output:
+ sed -E -e 's/<\/? ?(abbr|b|bdi|big|br|charinsert|code|dd|del|div|dl|dt|em|h1|h2|h3|h4|hr|i|kbd|li|mark|math|NDL|nowiki|ol|p|page|pagelist|pages|pre|ref|samp|small|span|strong|sub|sup|syntaxhighlight|templatedata|templatestyles|tt|u|ul|user|var)( ((alttext|class|dir|display|id|lang|title|xml:lang|xmlns)=\\?["'\''][^=<>"'\'']*\\?["'\'']))* ?\/?>//g' -e 's/<!--//g' -e 's/<https?:\/\/[a-zA-Z0-9./-]*>//g' + grep '<' + "apihelp-setglobalaccountstatus-param-statecheck": "קוד MD5 אופציונלי לשילוב הנוכחי הצפוי של <userid>:<username>:<hidden>:<locked>, כדי לזהות התנגשויות עריכה. הערך של <locked> צריך להיות 1 עבור \"נעול\" ו־0 עבור לא נעול.", + echo 'HTML detected. Manual review required' HTML detected. Manual review required + exit 1
The English message in question is "apihelp-setglobalaccountstatus-param-statecheck": "Optional MD5 of the expected current <userid>:<username>:<hidden>:<locked>, to detect edit conflicts. Set <locked> to 1 for locked, 0 for unlocked."
In addition to the above, the message is not entirely self-documenting. For example, the locked part is documented, but hidden isn't.
The solution to the false positive CI alerts is to remove all the literal < characters from the English message. Along the way, the message should have clearer usage documentation within itself.