Give write permissions to commit job only

Author: julianladisch

.github/workflows/update.yml

@@ -3,6 +3,8 @@ on:
   workflow_dispatch:
   schedule:
     - cron: '38 6 * * *'
+permissions:
+  contents: read
 jobs:
   update:
     runs-on: ubuntu-latest
@@ -42,9 +44,23 @@ jobs:
             fi
             mv /tmp/new.json $oldfile
           done
+      - uses: actions/upload-artifact@v4
+        with:
+          name: platform-complete
+          path: platform-complete/
+          retention-days: 1
+  commit:
+    needs: [update]
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    steps:
+      - uses: actions/checkout@v4
+      - run: rm -r platform-complete/
+      - uses: actions/download-artifact@v4
       - name: Commit updates
         run: |
-          git config --local user.name 'Translation update bot of Julian Ladisch'
-          git config --local user.email 'julianladisch@users.noreply.github.com'
+          git config --local user.name 'folio-translations repository bot'
+          git config --local user.email 'folio-translations@users.noreply.github.com'
           git add platform-complete/
           (git commit -m "Update translations" && git push) || true   # ignore failure caused by unchanged files