check-abap2UI5: only a push to main gets a token that can write (#98)

The workflow granted contents: write to every run, pull requests
included, for the one step that publishes the badges - a step that
already skipped itself on a pull request. The publish is its own job now
(`badges`, needs the gate job, runs on a push to main only, the one job
with contents: write); the gate job hands it the badge files as an
artifact, and the workflow default is contents: read.


Claude-Session: https://claude.ai/code/session_01Te3BRpRpxNhZAYnrQL6Gdt

Co-authored-by: Claude <noreply@anthropic.com>

Author: oblomov-dev

.github/workflows/check-abap2UI5.yaml

@@ -26,10 +26,10 @@ on:
   push:
     branches: [main]
 
-# contents: write is for the badge commit at the end of the job, and for
-# nothing else.
+# Read-only for every job; the `badges` job alone raises contents: write, and
+# it runs only on a push to main.
 permissions:
-  contents: write
+  contents: read
 
 concurrency:
   group: check-abap2UI5-${{ github.ref }}
@@ -50,19 +50,46 @@ jobs:
     - run: npx playwright install chromium --with-deps
     - run: npx abap2ui5lint
 
-    # The gate above rewrote .github/badges/ (abap2ui5lint.jsonc "badge"), and
-    # this step publishes those two files to the `badges` branch - an
-    # orphan branch that holds nothing else and is what the README badges
-    # read. Only on main: main is protected and github-actions[bot] cannot
-    # bypass that, and the old way round - committing the badges onto the
-    # pull request branch - started a second set of runs on that commit which
-    # waited for a maintainer's approval and left the pull request blocked.
-    # A pull request run publishes nothing; the run on main after the merge
-    # does. Only after a green gate, as before. A failed push (a ruleset on
-    # the branch) is a warning: the README then keeps showing the previous
-    # state rather than a wrong one.
+    # The badge files this run wrote go to the `badges` job below, which is
+    # the one job allowed to write to the repository - only on a push to
+    # main, and only after a green gate (the job needs this one).
+    - name: Hand the badges to the badges job
+      if: success() && github.event_name == 'push' && github.ref == 'refs/heads/main'
+      uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+      with:
+        name: badges
+        path: .github/badges/*.json
+        if-no-files-found: warn
+        retention-days: 1
+        include-hidden-files: true
+
+  # Publishes the two badge files to the `badges` branch - an orphan branch
+  # that holds nothing else and is what the README badges read. Its own job,
+  # and the only one with contents: write: a pull request run never gets a
+  # token that can write to the repository, not even in a job whose steps
+  # would skip the push. Only on main: main is protected and
+  # github-actions[bot] cannot bypass that, and the old way round -
+  # committing the badges onto the pull request branch - started a second set
+  # of runs on that commit which waited for a maintainer's approval and left
+  # the pull request blocked. A failed push (a ruleset on the branch) is a
+  # warning: the README then keeps showing the previous state rather than a
+  # wrong one.
+  badges:
+    needs: check-abap2UI5
+    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    permissions:
+      contents: write
+    steps:
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+    # no artifact when the gate wrote no badge files - the step below says so
+    - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
+      continue-on-error: true
+      with:
+        name: badges
+        path: .github/badges
     - name: Publish the badges
-      if: success() && github.event_name != 'pull_request' && github.ref == 'refs/heads/main'
       run: |
         ls .github/badges/*.json >/dev/null 2>&1 || { echo "::warning::The gate wrote no badge files - nothing to publish."; exit 0; }
         dir="$RUNNER_TEMP/badges"