ci: use two-stage format push

Author: winstxnhdw

.github/workflows/codeql.yml

@@ -6,42 +6,40 @@ on:
   pull_request:
     branches: [main]
   schedule:
-    - cron: '24 23 * * 0'
+    - cron: "24 23 * * 0"
 
 env:
   NUGET_PACKAGES: ${{ github.workspace }}\.nuget\packages
 
 permissions:
   security-events: write
-  actions: read
-  contents: read
 
 jobs:
   analyze:
     runs-on: windows-latest
 
     steps:
-    - name: Checkout repository
-      uses: actions/checkout@v6.0.2
-      with:
-        show-progress: false
-
-    - name: Initialise CodeQL
-      uses: github/codeql-action/init@v4.32.6
-      with:
-        languages: csharp
-
-    - name: Setup .NET
-      uses: actions/setup-dotnet@v5.2.0
-      with:
-        dotnet-version: 9.x
-        cache: true
-        cache-dependency-path: lc-hax\packages.lock.json
-
-    - name: Build
-      run: dotnet build lc-hax -restoreProperty:RestoreLockedMode=true
-
-    - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@v4.32.6
-      with:
-        category: /language:csharp
+      - name: Checkout repository
+        uses: actions/checkout@v6.0.2
+        with:
+          show-progress: false
+
+      - name: Initialise CodeQL
+        uses: github/codeql-action/init@v4.32.6
+        with:
+          languages: csharp
+
+      - name: Setup .NET
+        uses: actions/setup-dotnet@v5.2.0
+        with:
+          dotnet-version: 10.x
+          cache-dependency-path: lc-hax\packages.lock.json
+          cache: true
+
+      - name: Build
+        run: dotnet build lc-hax -restoreProperty:RestoreLockedMode=true
+
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@v4.32.6
+        with:
+          category: /language:csharp

.github/workflows/formatter.yml

@@ -9,38 +9,40 @@ on:
       - lc-hax/Scripts/**/*.cs
 
 concurrency: ${{ github.workflow }}-${{ github.ref }}
-permissions:
-  contents: write
+permissions: {}
 
 jobs:
   format:
     runs-on: ubuntu-slim
+    outputs:
+      patched: ${{ steps.patch.outputs.patched }}
 
     steps:
       - name: Checkout repository
         uses: actions/checkout@v6.0.2
         with:
           show-progress: false
+          persist-credentials: false
           repository: ${{ github.event.pull_request.head.repo.full_name }}
           ref: ${{ github.head_ref }}
 
       - name: Setup .NET
         uses: actions/setup-dotnet@v5.2.0
         with:
-          dotnet-version: 9.x
+          dotnet-version: 10.x
 
       - name: Format scripts
         run: |
           dotnet format lc-hax
           dotnet format analysers
 
-      - name: Set Git config
-        run: |
-          git config user.email github-actions[bot]@users.noreply.github.com
-          git config user.name github-actions[bot]
+      - name: Upload format patch
+        id: patch
+        uses: winstxnhdw/actions/upload-patch@main
 
-      - name: Commit changes
-        run: |
-          git commit -am "style: format scripts" || true
-          git pull --rebase origin ${{ github.head_ref || github.ref_name }}
-          git push origin HEAD:$BRANCH
+  push:
+    if: needs.format.outputs.patched
+    needs: format
+    uses: winstxnhdw/actions/.github/workflows/format-push.yml@main
+    permissions:
+      contents: write

.github/workflows/main.yml

@@ -25,8 +25,8 @@ jobs:
         uses: actions/setup-dotnet@v5.2.0
         with:
           dotnet-version: 10.x
-          cache: true
           cache-dependency-path: lc-hax\packages.lock.json
+          cache: true
 
       - name: Build
         run: dotnet build lc-hax -restoreProperty:RestoreLockedMode=true /warnaserror

.github/workflows/update-resource.yml

@@ -8,20 +8,25 @@ on:
       - lc-hax/*.csproj
 
 concurrency: Format-Resource-${{ github.ref }}
-permissions:
-  contents: write
+permissions: {}
+env:
+  BRANCH: ${{ github.head_ref || github.ref_name }}
+  PATCH_NAME: format.patch
+  ARTIFACT_NAME: format-patch
 
 jobs:
-  update-resource:
-    runs-on: ubuntu-latest
+  update:
+    runs-on: ubuntu-slim
+    outputs:
+      patched: ${{ steps.patch.outputs.patched }}
 
     steps:
       - name: Checkout repository
         uses: actions/checkout@v6.0.2
         with:
           show-progress: false
+          persist-credentials: false
           ref: ${{ github.head_ref }}
-          token: ${{ secrets.PAT }}
 
       - name: Cache .NET tools
         uses: actions/cache@v5.0.3
@@ -33,7 +38,7 @@ jobs:
       - name: Setup .NET
         uses: actions/setup-dotnet@v5.2.0
         with:
-          dotnet-version: 9.x
+          dotnet-version: 10.x
 
       - name: Restore tools
         run: dotnet tool restore
@@ -43,13 +48,13 @@ jobs:
         env:
           CSPROJ_PATH: lc-hax/lc-hax.csproj
 
-      - name: Set Git config
-        run: |
-          git config user.email github-actions[bot]@users.noreply.github.com
-          git config user.name github-actions[bot]
+      - name: Upload format patch
+        id: patch
+        uses: winstxnhdw/actions/upload-patch@main
 
-      - name: Commit changes
-        run: |
-          git commit -am "build: update resource path(s)" || true
-          git pull --rebase origin ${{ github.head_ref || github.ref_name }}
-          git push
+  push:
+    if: needs.update.outputs.patched
+    needs: update
+    uses: winstxnhdw/actions/.github/workflows/format-push.yml@main
+    permissions:
+      contents: write