Disable CI workflows on forked repositories (#1232)

* Restrict CI workflows to non-forked repositories

Add if: github.event.repository.fork == false to all workflow jobs to ensure CI only runs in the main repository. This improves security and conserves resources by preventing workflow execution in forked repos.

* Restrict Rust CLI build job to non-forked repos

Added a condition to the "Rust SDK Bundled CLI Build" job in rust-sdk-tests.yml to ensure it only runs when the workflow is triggered from the main repository, preventing execution on forked repositories.

Author: IeuanWalker

.github/workflows/codegen-check.yml

@@ -23,6 +23,7 @@ permissions:
 jobs:
   check:
     name: "Verify generated files are up-to-date"
+    if: github.event.repository.fork == false
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4

.github/workflows/copilot-setup-steps.yml

@@ -14,6 +14,7 @@ on:
 jobs:
   # The job MUST be called 'copilot-setup-steps' to be recognized by GitHub Copilot Agent
   copilot-setup-steps:
+    if: github.event.repository.fork == false
     runs-on: ubuntu-latest
 
     # Set minimal permissions for setup steps

.github/workflows/corrections-tests.yml

@@ -16,6 +16,7 @@ permissions:
 jobs:
   test:
     runs-on: ubuntu-latest
+    if: github.event.repository.fork == false
     steps:
       - uses: actions/checkout@v4
       - uses: actions/setup-node@v4

.github/workflows/docs-validation.yml

@@ -20,6 +20,7 @@ permissions:
 jobs:
   validate-typescript:
     name: "Validate TypeScript"
+    if: github.event.repository.fork == false
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v6
@@ -44,6 +45,7 @@ jobs:
 
   validate-python:
     name: "Validate Python"
+    if: github.event.repository.fork == false
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v6
@@ -76,6 +78,7 @@ jobs:
 
   validate-go:
     name: "Validate Go"
+    if: github.event.repository.fork == false
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v6
@@ -99,6 +102,7 @@ jobs:
 
   validate-csharp:
     name: "Validate C#"
+    if: github.event.repository.fork == false
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v6

.github/workflows/dotnet-sdk-tests.yml

@@ -29,6 +29,7 @@ permissions:
 jobs:
   test:
     name: ".NET SDK Tests"
+    if: github.event.repository.fork == false
     env:
       POWERSHELL_UPDATECHECK: Off
     strategy:

.github/workflows/go-sdk-tests.yml

@@ -30,6 +30,7 @@ permissions:
 jobs:
   test:
     name: "Go SDK Tests"
+    if: github.event.repository.fork == false
     env:
       POWERSHELL_UPDATECHECK: Off
     strategy:

.github/workflows/nodejs-sdk-tests.yml

@@ -32,6 +32,7 @@ permissions:
 jobs:
   test:
     name: "Node.js SDK Tests"
+    if: github.event.repository.fork == false
     env:
       POWERSHELL_UPDATECHECK: Off
     strategy:

.github/workflows/python-sdk-tests.yml

@@ -32,6 +32,7 @@ permissions:
 jobs:
   test:
     name: "Python SDK Tests"
+    if: github.event.repository.fork == false
     env:
       POWERSHELL_UPDATECHECK: Off
     strategy:

.github/workflows/rust-publish-release.yml

@@ -24,6 +24,7 @@ concurrency:
 jobs:
   publish:
     name: Publish to crates.io
+    if: github.event.repository.fork == false
     runs-on: ubuntu-latest
     defaults:
       run:

.github/workflows/rust-sdk-tests.yml

@@ -30,6 +30,7 @@ permissions:
 jobs:
   test:
     name: "Rust SDK Tests"
+    if: github.event.repository.fork == false
     env:
       POWERSHELL_UPDATECHECK: Off
       CARGO_TERM_COLOR: always
@@ -119,6 +120,7 @@ jobs:
   # bundled-CLI release pipeline) hit them downstream.
   bundle:
     name: "Rust SDK Bundled CLI Build"
+    if: github.event.repository.fork == false
     env:
       CARGO_TERM_COLOR: always
       RUST_BACKTRACE: 1