ci: add fork guards to docker, release, and auto-tag workflows (#1007)

.github/workflows/auto-tag-on-release-pr-merge.yml

@@ -13,7 +13,8 @@ jobs:
   auto-tag:
     if: >
       github.event.pull_request.merged == true &&
-      startsWith(github.event.pull_request.head.ref, 'version-bump/')
+      startsWith(github.event.pull_request.head.ref, 'version-bump/') &&
+      github.event.pull_request.head.repo.full_name == github.repository
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6

.github/workflows/docker.yml

@@ -132,7 +132,7 @@ jobs:
           cache-from: |
             type=registry,ref=${{ env.IMAGE_NAME }}-buildcache:${{ matrix.arch }}
           cache-to: |
-            type=registry,ref=${{ env.IMAGE_NAME }}-buildcache:${{ matrix.arch }},mode=max,compression=zstd
+            ${{ (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository) && format('type=registry,ref={0}-buildcache:{1},mode=max,compression=zstd', env.IMAGE_NAME, matrix.arch) || '' }}
 
       - name: Export digest
         if: github.event_name != 'pull_request'

.github/workflows/release.yml

@@ -17,6 +17,7 @@ on:
 jobs:
   release:
     name: Release
+    if: github.repository == 'block/sprout'
     runs-on: macos-latest
     timeout-minutes: 60
     permissions:
@@ -261,6 +262,7 @@ jobs:
 
   release-macos-x64:
     name: Release macOS (Intel)
+    if: github.repository == 'block/sprout'
     runs-on: macos-latest
     needs: release
     timeout-minutes: 60
@@ -366,6 +368,7 @@ jobs:
 
   release-linux:
     name: Release Linux
+    if: github.repository == 'block/sprout'
     runs-on: ubuntu-latest
     needs: release
     timeout-minutes: 60