ci: restrict sensitive workflow jobs to upstream repository only

.github/workflows/ci-cd-production.yaml

@@ -17,6 +17,7 @@ env:
 jobs:
   run-ci-cd:
     name: Run production CI/CD
+    if: github.event.repository.fork == false
     permissions:
       actions: write
       attestations: write

.github/workflows/ci-cd-staging.yaml

@@ -17,6 +17,7 @@ env:
 jobs:
   run-ci-cd:
     name: Run staging CI/CD
+    if: github.event.repository.fork == false
     permissions:
       actions: write
       attestations: write

.github/workflows/code-ql-actions.yaml

@@ -28,6 +28,7 @@ env:
 jobs:
   run-code-ql:
     name: CodeQL Actions
+    if: github.event.repository.fork == false
     permissions:
       contents: read
       security-events: write

.github/workflows/code-ql-javascript-typescript.yaml

@@ -44,6 +44,7 @@ env:
 jobs:
   run-code-ql:
     name: CodeQL JavaScript/TypeScript
+    if: github.event.repository.fork == false
     permissions:
       contents: read
       security-events: write

.github/workflows/code-ql-python.yaml

@@ -34,6 +34,7 @@ env:
 jobs:
   run-code-ql:
     name: CodeQL Python
+    if: github.event.repository.fork == false
     permissions:
       contents: read
       security-events: write

.github/workflows/dependency-review.yaml

@@ -21,6 +21,7 @@ permissions: {}
 jobs:
   dependency-review:
     name: Dependency review
+    if: github.event.repository.fork == false
     permissions:
       contents: read
     runs-on: ubuntu-latest

.github/workflows/run-code-tests.yaml

@@ -9,6 +9,12 @@ env:
   FORCE_COLOR: 1
 
 jobs:
+  check-fork:
+    if: github.event.repository.fork == false
+    runs-on: ubuntu-latest
+    steps:
+      - run: echo "Not a fork,continuing the workflow"
+
   run-backend-tests:
     name: Backend tests
     permissions:
@@ -18,8 +24,8 @@ jobs:
 
   run-backend-coverage-upload:
     name: Backend coverage upload
-    if: github.event.repository.fork == false
     needs:
+      - check-fork
       - run-backend-tests
     permissions:
       actions: read
@@ -41,8 +47,8 @@ jobs:
 
   run-frontend-coverage-upload:
     name: Frontend coverage upload
-    if: github.event.repository.fork == false
     needs:
+      - check-fork
       - run-frontend-tests
     permissions:
       actions: read