ci: fix the update-models workflow

.github/workflows/update-models.yaml

@@ -6,7 +6,7 @@ on:
   workflow_dispatch:
 
 permissions:
-  contents: write
+  contents: read
 
 concurrency:
   group: update-models
@@ -26,67 +26,65 @@ jobs:
       RUSTFLAGS: --deny warnings
 
     steps:
-    - uses: actions/checkout@v4
-      with:
-        persist-credentials: true
+      - uses: actions/checkout@v4
+        with:
+          ssh-key: ${{ secrets.RELEASE_BOT_SSH_KEY }}
+          persist-credentials: true
 
-    - name: Install Rust Toolchain Components
-      uses: dtolnay/rust-toolchain@stable
+      - name: Install Rust Toolchain Components
+        uses: dtolnay/rust-toolchain@stable
 
-    - uses: Swatinem/rust-cache@v2
+      - uses: Swatinem/rust-cache@v2
 
-    - name: Cache DuckDB Extensions
-      id: duckdb-extensions
-      uses: actions/cache@v4
-      with:
-        path: ~/.duckdb/extensions
-        key: duckdb-ext-ubuntu-latest-${{ hashFiles('Cargo.lock') }}
+      - name: Cache DuckDB Extensions
+        id: duckdb-extensions
+        uses: actions/cache@v4
+        with:
+          path: ~/.duckdb/extensions
+          key: duckdb-ext-ubuntu-latest-${{ hashFiles('Cargo.lock') }}
 
-    - name: Install DuckDB Extensions
-      if: steps.duckdb-extensions.outputs.cache-hit != 'true'
-      run: cargo test --all duckdb
+      - name: Install DuckDB Extensions
+        if: steps.duckdb-extensions.outputs.cache-hit != 'true'
+        run: cargo test --all duckdb
 
-    - name: Write stub config
-      run: |
-        COYOTE_CONFIG_DIR="$(mktemp -d)"
-        printf 'clients:\n  - type: openai\n  - type: claude\n' > "$COYOTE_CONFIG_DIR/config.yaml"
-        echo "COYOTE_CONFIG_DIR=$COYOTE_CONFIG_DIR" >> "$GITHUB_ENV"
+      - name: Write stub config
+        run: |
+          COYOTE_CONFIG_DIR="$(mktemp -d)"
+          printf 'clients:\n  - type: openai\n  - type: claude\n' > "$COYOTE_CONFIG_DIR/config.yaml"
+          echo "COYOTE_CONFIG_DIR=$COYOTE_CONFIG_DIR" >> "$GITHUB_ENV"
 
-    - name: Regenerate model catalog
-      run: cargo run --release -- --generate-models
+      - name: Regenerate model catalog
+        run: cargo run --release -- --generate-models
 
-    - name: Detect catalog changes
-      id: diff
-      run: echo "changed=$(git diff --quiet models.yaml && echo false || echo true)" >> "$GITHUB_OUTPUT"
+      - name: Detect catalog changes
+        id: diff
+        run: echo "changed=$(git diff --quiet models.yaml && echo false || echo true)" >> "$GITHUB_OUTPUT"
 
-    # The binary built by the regeneration step embedded the OLD models.yaml (the file
-    # was rewritten after that build), so rebuild before smoke-testing: cargo tracks
-    # include_str! inputs, making this a cheap incremental rebuild of the final crate.
-    - name: Rebuild with the refreshed catalog
-      if: steps.diff.outputs.changed == 'true'
-      run: cargo build --release
+      # The binary built by the regeneration step embedded the OLD models.yaml (the file
+      # was rewritten after that build), so rebuild before smoke-testing: cargo tracks
+      # include_str! inputs, making this a cheap incremental rebuild of the final crate.
+      - name: Rebuild with the refreshed catalog
+        if: steps.diff.outputs.changed == 'true'
+        run: cargo build --release
 
-    - name: Test
-      if: steps.diff.outputs.changed == 'true'
-      run: cargo test --all
+      - name: Test
+        if: steps.diff.outputs.changed == 'true'
+        run: cargo test --all
 
-    - name: Smoke test the refreshed catalog
-      if: steps.diff.outputs.changed == 'true'
-      run: |
-        COUNT=$(./target/release/coyote --list-models | wc -l)
-        echo "Listed $COUNT chat models"
-        test "$COUNT" -ge 40
+      - name: Smoke test the refreshed catalog
+        if: steps.diff.outputs.changed == 'true'
+        run: |
+          COUNT=$(./target/release/coyote --list-models | wc -l)
+          echo "Listed $COUNT chat models"
+          test "$COUNT" -ge 40
 
-    # Pushes made with the default GITHUB_TOKEN do not trigger other workflows,
-    # so this push cannot start a workflow loop. The pull --rebase covers a human
-    # push landing mid-run; if the race is lost anyway, the next cron run retries.
-    - name: Commit and push
-      if: steps.diff.outputs.changed == 'true'
-      run: |
-        git add models.yaml
-        git checkout -- .
-        git config user.name 'github-actions[bot]'
-        git config user.email '41898282+github-actions[bot]@users.noreply.github.com'
-        git commit -m 'chore: refresh generated model catalog'
-        git pull --rebase origin main
-        git push origin main
+      - name: Commit and push
+        if: steps.diff.outputs.changed == 'true'
+        run: |
+          git add models.yaml
+          git checkout -- .
+          git config user.name 'github-actions[bot]'
+          git config user.email '41898282+github-actions[bot]@users.noreply.github.com'
+          git commit -m 'chore: refresh generated model catalog [skip ci]'
+          git pull --rebase origin main
+          git push origin main