Credential handling
The service-account key stays outside the repository in a restricted local or client-owned secret location. The reporting workflow requests the read-only webmasters scope and supports an environment variable pointing to the key file.