security: add same-repo PR guard (P1 — fork PR protection)

.github/workflows/base120.yml

@@ -14,6 +14,7 @@ on:
 
 jobs:
   mirror-guard:
+    if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
     runs-on: [self-hosted, Linux, X64, wsl, base120]
     steps:
       - uses: actions/[email protected]
@@ -25,6 +26,7 @@ jobs:
           fi
 
   test:
+    if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
     runs-on: [self-hosted, Linux, X64, wsl, base120]
     steps:
       - uses: actions/[email protected]

.github/workflows/ci.yml

@@ -8,33 +8,34 @@
 
 jobs:
   test:
+    if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
     runs-on: [self-hosted, Linux, X64, wsl, base120]
     strategy:
       matrix:
         python-version: ["3.11", "3.12"]
     steps:
       - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
 
       - name: Set up Python ${{ matrix.python-version }}
         uses: actions/setup-python@v5
         with:
           python-version: ${{ matrix.python-version }}
 
       - name: Install dependencies
         run: |
           python -m pip install --upgrade pip
           pip install -e ".[test]"
 
       - name: Check for accidentally tracked Python cache
         run: |
           CACHED=$(git ls-files | grep -E '__pycache__|\.pyc$|\.pyo$' || true)
           if [ -n "$CACHED" ]; then
             echo "ERROR: Python cache files found in git index:"
             echo "$CACHED"
             echo "Run: git rm -r --cached __pycache__ && git rm --cached '*.pyc' '*.pyo'"
             exit 1
           fi
           echo "OK: No Python cache files in git index"
 
       - name: Run tests
         run: python -m pytest tests/ -v

.github/workflows/guardrails.yml

@@ -11,6 +11,7 @@ on:
 
 jobs:
   corpus:
+    if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
     runs-on: [self-hosted, Linux, X64, wsl, base120]
     steps:
       - uses: actions/[email protected]