Don't persist credentials longer than necessary in GitHub release-site actions

Author: robtimus

.github/workflows/release-site.yml

@@ -22,10 +22,12 @@ permissions:
   contents: write
 
 jobs:
-  release-site:
+  build-site:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v5
+        with:
+          persist-credentials: false
       - name: Set up JDK 11
         uses: actions/setup-java@v5
         with:
@@ -40,6 +42,23 @@ jobs:
               echo "Moving site for module $module to target/site"
               mv $module/target/site target/site/$module
           done
+      - uses: actions/upload-artifact@v4
+        with:
+          name: site
+          path: target/site
+          retention-days: 1
+
+  deploy-site:
+    runs-on: ubuntu-latest
+    needs: ['build-site']
+    steps:
+      - uses: actions/checkout@v5
+        with:
+          persist-credentials: true
+      - uses: actions/download-artifact@v5
+        with:
+          name: site
+          path: target/site
       - name: Deploy to gh-pages
         uses: JamesIves/github-pages-deploy-action@v4
         with: