Add proper permissions to CI job

.github/workflows/cd.yml

@@ -2,7 +2,6 @@ name: Sync to Hugging Face hub
 on:
   push:
     branches: [main]
-  pull_request:
 
   # to run this workflow manually from the Actions tab
   workflow_dispatch:
@@ -18,5 +17,8 @@ jobs:
           lfs: true
       - name: Push to hub
         env:
+          HF_USERNAME: ${{ env.HF_USERNAME }}
+          HF_ORGANIZATION: ${{ env.HF_ORGANIZATION }}
+          SPACE_NAME: ${{ env.SPACE_NAME }}
           HF_TOKEN: ${{ secrets.HF_TOKEN }}
-        run: git push https://HF_USERNAME:[email protected]/spaces/HF_ORGANIZATION/SPACE_NAME main
+        run: git push https://$HF_USERNAME:[email protected]/spaces/$HF_ORGANIZATION/$SPACE_NAME main

.github/workflows/ci.yml

@@ -1,16 +1,20 @@
 name: Continuous integration
-on: [push, pull_request]
+on: [pull_request]
 jobs:
-  docker-build:
+  check-files-size:
     runs-on: ubuntu-latest
+    permissions:
+        pull-requests: write
     steps:
         - name: Check out the repo
           uses: actions/checkout@v4
-        - run: docker build .
-  check-files-size:
+        - name: Check large files
+          uses: ppremk/lfs-[email protected]
+          with:
+            filesizelimit: 10485760 # this is 10MB so we can sync to HF Spaces
+  docker-build:
     runs-on: ubuntu-latest
     steps:
-      - name: Check large files
-        uses: ppremk/lfs-warning@v3.2
-        with:
-          filesizelimit: 10485760 # this is 10MB so we can sync to HF Spaces
+        - name: Check out the repo
+          uses: actions/checkout@v4
+        - run: docker build .