[Florian Ruppel (fruppel)]

Splits the Q&A workflow by privilege:

• run-checks: read-only token, no persisted credentials, no secrets; uploads the generated Flex endpoint and recipe diff as an artifact
• publish: no PR checkout; pushes the endpoint JSON to flex/pull-<number> and posts the diff comment
• create-project: runs without any token permissions

CI_COMMIT_PAT is no longer used. Actions are pinned to commit SHAs.

qa.yml calls callable-qa.yml@main, so the new jobs only take effect after merge.

[github-actions]

Thanks for the PR 😍

How to test these changes in your application

1. Add the Shopware flex endpoint in your composer.json to https://raw.githubusercontent.com/shopware/recipes/flex/pull-269/index.json.

   # When jq is installed
   jq '.extra.symfony.endpoint |= [ "https://raw.githubusercontent.com/shopware/recipes/flex/pull-269/index.json" ] + .' composer.json > composer.tmp && mv composer.tmp composer.json

   or manually

   "endpoint": [
       "https://raw.githubusercontent.com/shopware/recipes/flex/pull-269/index.json",
       "https://raw.githubusercontent.com/shopware/recipes/flex/main/index.json",
       "flex://defaults"
   ]
   # On Unix-like (BSD, Linux and macOS)
   export SYMFONY_ENDPOINT=https://raw.githubusercontent.com/shopware/recipes/flex/pull-269/index.json
   # On Windows
   SET SYMFONY_ENDPOINT=https://raw.githubusercontent.com/shopware/recipes/flex/pull-269/index.json

2. Install the package(s) related to this recipe:

   composer req 

Diff between recipe versions

In order to help with the review stage, I'm in charge of computing the diff between the various versions of patched recipes.
I'm going keep this comment up to date with any updates of the attached patch.