fix: handle progress publish with restricted token

.github/workflows/build.yml

@@ -43,13 +43,6 @@ jobs:
         if: ${{ github.event_name == 'push' }}
         uses: actions/checkout@master
 
-      - name: Checkout gh-pages
-        if: ${{ github.event_name == 'push' }}
-        uses: actions/checkout@master
-        with:
-          path: gh-pages
-          ref: gh-pages
-
       - name: Checkout agbcc
         uses: actions/checkout@master
         with:
@@ -83,7 +76,6 @@ jobs:
           cd chao_garden && python3 ../scripts/progress.py -f mb_chao_garden.map text
 
       - name: Generate reports
-        if: ${{ github.event_name == 'push' }}
         run: |
           mkdir -p gh-pages/reports
           mkdir -p gh-pages/maps
@@ -95,7 +87,6 @@ jobs:
           cp sa2.map gh-pages/maps/${GITHUB_SHA}.map
 
       - name: Generate reports (Collect Rings)
-        if: ${{ github.event_name == 'push' }}
         run: |
           cd multi_boot/roms/collect_rings
           python3 ../../../scripts/progress.py csv -f collect_rings.map >> ../../../gh-pages/reports/progress-collect_rings-nonmatching.csv
@@ -104,15 +95,43 @@ jobs:
           python3 ../../../scripts/progress.py shield-json -m -f collect_rings.map > ../../../gh-pages/reports/progress-collect_rings-shield-matching.json
 
       - name: Generate reports (Chao Garden)
-        if: ${{ github.event_name == 'push' }}
         run: |
           cd chao_garden
           python3 ../scripts/progress.py csv -f mb_chao_garden.map >> ../gh-pages/reports/progress-mb_chao_garden-nonmatching.csv
           python3 ../scripts/progress.py csv -m -f mb_chao_garden.map >> ../gh-pages/reports/progress-mb_chao_garden-matching.csv
           python3 ../scripts/progress.py shield-json -f mb_chao_garden.map > ../gh-pages/reports/progress-mb_chao_garden-shield.json
           python3 ../scripts/progress.py shield-json -m -f mb_chao_garden.map > ../gh-pages/reports/progress-mb_chao_garden-shield-matching.json
 
-      - name: Update reports
+      - name: Upload progress
+        if: ${{ github.event_name == 'push' || github.event_name == 'pull_request' }}
+        uses: actions/upload-artifact@v7
+        with:
+          path: |
+            gh-pages
+
+  publish-progress:
+    name: Publish progress
+    runs-on: ubuntu-24.04
+    needs: [build-gba]
+    # Only able to run from repo pull requests (by maintainers, or on the main branch via push)
+    if: ${{ github.event_name == 'push' || github.event_name == 'pull_request' }}
+    permissions:
+      contents: write
+    steps:
+      - name: Checkout gh-pages
+        uses: actions/checkout@master
+        with:
+          path: gh-pages
+          ref: gh-pages
+      - name: Download progress
+        uses: actions/download-artifact@v7
+        with:
+          path: |
+            gh-pages
+      - run: |
+          cd gh-pages
+          git status
+      - name: Publish reports
         if: ${{ github.event_name == 'push' }}
         uses: EndBug/add-and-commit@v7
         with: