Correct translation workflow

.github/workflows/translate.yml

@@ -14,23 +14,21 @@ env:
 jobs:
   update-translations:
     name: Update Translations
-    if: github.actor != 'brutusthebee'
+    if: github.repository == 'beeware/beeware-tutorial' && github.actor != 'brutusthebee'
     runs-on: ubuntu-latest
-    permissions:
-      contents: read
+    # GitHub writes use BRUTUS_PAT_TOKEN, so the job's own GITHUB_TOKEN needs
+    # no permissions.
+    permissions: {}
     steps:
       - name: Checkout
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           fetch-depth: 1
           token: ${{ secrets.BRUTUS_PAT_TOKEN }}
-          # Don't persist the token in .git/config (avoids the artipacked
-          # credential-leak vector); pushes are authenticated via the gh
-          # credential helper configured in "Configure git" below.
           persist-credentials: false
 
       - name: Set up Python
-        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97  # v7.0.0
         with:
           python-version: "3.X"
           cache: pip
@@ -42,30 +40,32 @@ jobs:
         run: python -m pip install -U pip
 
       - name: Install tox
-        run: python -m pip install --group 'translate'
+        run: python -m pip install --group translate
 
       - name: Configure git
         env:
           GH_TOKEN: ${{ secrets.BRUTUS_PAT_TOKEN }}
         run: |
           git config --local user.email "$(git log --pretty='%ae' -1)"
           git config --local user.name "brutusthebee[bot]"
-          # Authenticate git via the gh credential helper using BRUTUS_PAT_TOKEN,
-          # rather than a token persisted by actions/checkout.
           gh auth setup-git
 
       - name: Configure Weblate
         env:
-         WEBLATE_API_TOKEN: ${{ secrets.WEBLATE_API_TOKEN }}
+          WEBLATE_API_TOKEN: ${{ secrets.WEBLATE_API_TOKEN }}
         run: |
-         cat <<EOF > ~/.weblate
-         [weblate]
-         url = https://hosted.weblate.org/api/
-         translation = beeware/tutorial
-
-         [keys]
-         https://hosted.weblate.org/api/ = $WEBLATE_API_TOKEN
-         EOF
+          cat <<EOF > ~/.weblate
+          [weblate]
+          url = https://hosted.weblate.org/api/
+          translation = beeware/tutorial
+          retries = 5
+          backoff_factor = 2
+          status_forcelist = 423,502
+          allowed_methods = GET,POST,PUT,DELETE,HEAD,OPTIONS
+
+          [keys]
+          https://hosted.weblate.org/api/ = $WEBLATE_API_TOKEN
+          EOF
 
       - name: Lock Weblate and Sync
         run: wlc lock
@@ -74,6 +74,8 @@ jobs:
       - name: Push Weblate changes
         run: wlc push
       - name: Pull translation updates pushed by Weblate
+        env:
+          GH_TOKEN: ${{ secrets.BRUTUS_PAT_TOKEN }}
         run: git pull origin
 
       - name: Regenerate PO files
@@ -94,7 +96,7 @@ jobs:
       - name: Commit updated translations
         if: steps.updated.outputs.updated == 'true'
         env:
-          GITHUB_TOKEN: ${{ github.token }}
+          GH_TOKEN: ${{ secrets.BRUTUS_PAT_TOKEN }}
         run: |
           # Commit the updated PO files.
           git add docs/locales
@@ -106,6 +108,7 @@ jobs:
         run: wlc pull
 
       - name: Unlock Weblate
+        if: always()
         run: wlc unlock
 
       # # This step is only needed if you're trying to diagnose test failures that