Read-only token for pull request lint runs, abaplint 2.120.75

[oblomov-dev]

What changes

• Pull request runs of check-abap2ui5 get a read-only token. The workflow granted contents: write to the whole run only so that its last step could push the badges to the badges branch on main - which also handed a write token to every pull request run from a branch of this repository while it ran that branch's code (npm ci, the linter). Now:
  • workflow default permissions: contents: read;
  • the gate job (same name, so required checks are unchanged) uploads .github/badges/*.json as a one-day artifact - only on main and only after a green gate;
  • a new publish-badges job (needs: the gate, permissions: contents: write, guarded by github.event_name != 'pull_request' && github.ref == 'refs/heads/main') downloads them and pushes to badges with the unchanged script (same worktree/orphan-branch logic, same commit message, same warning on a refused push).
  • Choice: the guard keeps the current event set (push, the weekly schedule and a manual run on main all publish) rather than push only, so a green scheduled run still refreshes the badges as today. A pull request never reaches the job. Artifact actions are pinned to the SHAs abap2UI5 uses (upload-artifact v7.0.2, download-artifact v8.0.2).
  • Verifiable only after merge: the first run on main should show publish-badges green and a new commit on badges (or "up to date").
• abaplint 2.120.75 (package.json + lockfile; the workflows run it through npx). No new findings.

Checks

npm run check locally: abaplint (standard and cloud) 0 issues, abap2UI5 linter 0 failing, rename build OK.

🤖 Generated with Claude Code

https://claude.ai/code/session_01Te3BRpRpxNhZAYnrQL6Gdt

---

Generated by Claude Code