Split workflow in two

.github/workflows/import-translations.yml

@@ -1,6 +1,6 @@
 name: Import translations from Weblate
 
-on: [pull_request_target]
+on: [pull_request]
 
 jobs:
   import:
@@ -11,9 +11,6 @@ jobs:
     # Test with Ortham's account
     if: ${{ github.event.sender.id ==  2430738 && github.event.pull_request.maintainer_can_modify == true }}
 
-    permissions:
-      contents: write
-
     steps:
       - uses: actions/checkout@v4
         with:
@@ -23,15 +20,6 @@ jobs:
         with:
           python-version: '3.10'
 
-      - name: Checkout the PR source branch
-        run: |
-          git config user.name "github-actions[bot]"
-          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
-
-          git remote add weblate ${{ github.event.pull_request.head.repo.clone_url }}
-          git fetch weblate
-          git checkout ${{ github.event.pull_request.head.ref }}
-
       - name: Install dependencies
         run: |
           python -m venv .venv
@@ -44,8 +32,11 @@ jobs:
       - name: Run the export translations script
         run: python scripts/export-translations.py
 
-      - name: Commit and push changes
-        run: |
-          git add .
-          git commit -m "Import translations from Weblate"
-          git push
+      - name: Create patch containing changes
+        run: git diff > sync-translations.patch
+
+      - name: Upload patch
+        uses: actions/upload-artifact@v4
+        with:
+          name: sync-translations.patch
+          path: sync-translations.patch

.github/workflows/push-changes.yml

@@ -0,0 +1,42 @@
+name: Import translations from Weblate
+
+on:
+  workflow_run:
+    workflows: [Import translations from Weblate]
+    types: [completed]
+
+jobs:
+  import:
+    runs-on: ubuntu-20.04
+
+    if: >
+      github.event.workflow_run.event == 'pull_request' &&
+      github.event.workflow_run.conclusion == 'success'
+
+    permissions:
+      contents: write
+
+    steps:
+      - name: Download the patch artifact
+        uses: actions/download-artifact@v4
+        with:
+          name: sync-translations.patch
+          run-id: ${{ github.event.workflow_run.id }}
+
+      - name: Checkout the PR source branch
+        run: |
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+
+          git remote add weblate ${{ github.event.pull_request.head.repo.clone_url }}
+          git fetch weblate
+          git checkout ${{ github.event.pull_request.head.ref }}
+
+      - name: Apply the patch
+        run: git apply sync-translations.patch
+
+      - name: Commit and push changes
+        run: |
+          git add .
+          git commit -m "Import translations from Weblate"
+          git push