Run PR comment posting as separate job with appropriate permissions.

Author: detly

.github/workflows/check-binary-size.yml

@@ -20,6 +20,13 @@ jobs:
       TEST_MAIN_RS: foo.rs
       BASE_COMMIT: ${{ github.event.pull_request.base.sha }}
       HEAD_COMMIT: ${{ github.event.pull_request.head.sha }}
+    outputs:
+      binary-size-reference:
+        description: The size in bytes of the test binary built from the PR base
+        value: ${{ steps.size-reference.outputs.test-binary-size }}
+      binary-size-updated:
+        description: The size in bytes of the test binary built from the PR head
+        value: ${{ steps.size-updated.outputs.test-binary-size }}
     steps:
       - name: Print info
         run: |
@@ -74,11 +81,18 @@ jobs:
           main-rs: ${{ env.TEST_MAIN_RS }}
           rustc-dir: ${{ env.RUSTC_DIR }}
         id: size-updated
+  report:
+    name: Report binary size changes
+    runs-on: ubuntu-latest
+    needs: measure
+    permissions:
+      pull-request: write
+    steps:
       - name: Post a PR comment if the size has changed
         uses: actions/github-script@v6
         env:
-          SIZE_REFERENCE: ${{ steps.size-reference.outputs.test-binary-size }}
-          SIZE_UPDATED: ${{ steps.size-updated.outputs.test-binary-size }}
+          SIZE_REFERENCE: ${{ needs.measure.outputs.binary-size-reference }}
+          SIZE_UPDATED: ${{ needs.measure.outputs.binary-size-reference }}
         with:
           script: |
             const reference = process.env.SIZE_REFERENCE;