Try to split workflows

.github/workflows/bundle_analysis_comment.yml

@@ -0,0 +1,63 @@
+name: "Bundle Analysis Comment"
+
+on:
+  workflow_run:
+    workflows: ["Bundle Analysis Upload"]
+    types:
+      - completed
+
+jobs:
+  comment:
+    runs-on: ubuntu-latest
+    if: >
+      ${{ github.event.workflow_run.event == 'pull_request' &&
+      github.event.workflow_run.conclusion == 'success' }}
+    steps:
+      - name: Download base branch bundle stats
+        uses: dawidd6/action-download-artifact@v2
+        if: success() && github.event.number
+        with:
+          workflow: bundle_analysis_upload.yml
+          name: analysis_comment.txt
+          path: analysis_comment.txt
+
+      - name: Get comment body
+        id: get-comment-body
+        if: success() && github.event.number
+        run: |
+          body=$(cat analysis_comment.txt)
+          body="## Size Changes
+          <details>
+
+          ${body}
+          
+          </details>"
+          body="${body//'%'/'%25'}"
+          body="${body//$'\n'/'%0A'}"
+          body="${body//$'\r'/'%0D'}"
+          echo ::set-output name=body::$body
+        working-directory: beta
+
+      - name: Find Comment
+        uses: peter-evans/find-comment@v1
+        if: success() && github.event.number
+        id: fc
+        with:
+          issue-number: ${{ github.event.number }}
+          body-includes: "<!-- __NEXTJS_BUNDLE -->"
+
+      - name: Create Comment
+        uses: peter-evans/create-or-update-comment@v1.4.4
+        if: success() && github.event.number && steps.fc.outputs.comment-id == 0
+        with:
+          issue-number: ${{ github.event.number }}
+          body: ${{ steps.get-comment-body.outputs.body }}
+
+      - name: Update Comment
+        uses: peter-evans/create-or-update-comment@v1.4.4
+        if: success() && github.event.number && steps.fc.outputs.comment-id != 0
+        with:
+          issue-number: ${{ github.event.number }}
+          body: ${{ steps.get-comment-body.outputs.body }}
+          comment-id: ${{ steps.fc.outputs.comment-id }}
+          edit-mode: replace

.github/workflows/nextjs_bundle_analysis.yml → .github/workflows/bundle_analysis_upload.yml

@@ -1,4 +1,4 @@
-name: "Next.js Bundle Analysis"
+name: "Bundle Analysis Upload"
 
 on:
   pull_request:
@@ -47,15 +47,16 @@ jobs:
       - name: Upload bundle
         uses: actions/upload-artifact@v2
         with:
-          name: bundle
           path: beta/.next/analyze/__bundle_analysis.json
+          name: bundle_analysis.json
 
       - name: Download base branch bundle stats
         uses: dawidd6/action-download-artifact@v2
         if: success() && github.event.number
         with:
-          workflow: nextjs_bundle_analysis.yml
+          workflow: bundle_analysis_upload.yml
           branch: ${{ github.event.pull_request.base.ref }}
+          name: bundle_analysis.json
           path: beta/.next/analyze/base
 
       # And here's the second place - this runs after we have both the current and
@@ -76,43 +77,11 @@ jobs:
         run: ls -laR .next/analyze/base && npx -p nextjs-bundle-analysis compare
         working-directory: beta
 
-      - name: Get comment body
-        id: get-comment-body
-        if: success() && github.event.number
-        run: |
-          body=$(cat .next/analyze/__bundle_analysis_comment.txt)
-          body="## Size Changes
-          <details>
-
-          ${body}
-          
-          </details>"
-          body="${body//'%'/'%25'}"
-          body="${body//$'\n'/'%0A'}"
-          body="${body//$'\r'/'%0D'}"
-          echo ::set-output name=body::$body
-        working-directory: beta
-
-      - name: Find Comment
-        uses: peter-evans/find-comment@v1
-        if: success() && github.event.number
-        id: fc
-        with:
-          issue-number: ${{ github.event.number }}
-          body-includes: "<!-- __NEXTJS_BUNDLE -->"
-
-      - name: Create Comment
-        uses: peter-evans/create-or-update-comment@v1.4.4
-        if: success() && github.event.number && steps.fc.outputs.comment-id == 0
+      - name: Upload analysis comment
+        uses: actions/upload-artifact@v2
         with:
-          issue-number: ${{ github.event.number }}
-          body: ${{ steps.get-comment-body.outputs.body }}
+          name: analysis_comment.txt
+          path: .next/analyze/__bundle_analysis_comment.txt
 
-      - name: Update Comment
-        uses: peter-evans/create-or-update-comment@v1.4.4
-        if: success() && github.event.number && steps.fc.outputs.comment-id != 0
-        with:
-          issue-number: ${{ github.event.number }}
-          body: ${{ steps.get-comment-body.outputs.body }}
-          comment-id: ${{ steps.fc.outputs.comment-id }}
-          edit-mode: replace
+      # The actual commenting happens in the other action, matching the guidance in
+      # https://securitylab.github.com/research/github-actions-preventing-pwn-requests/