ci: skip SQLFluff Annotate on fork PRs

ignore-unauthorized-error does not catch the fork 403
(Resource not accessible by integration). Skip Annotate when
head.repo != base repo so lint-mimic-iv can stay green.

Author: Chessing234

.github/workflows/lint_sqlfluff.yml

@@ -1,7 +1,8 @@
 name: SQLFluff
 
 # Lints changed mimic-iv/concepts/*.sql on pull requests and posts GitHub
-# annotations. permissions + ignore-unauthorized-error keep fork PRs usable.
+# annotations. Fork PRs skip Annotate — GITHUB_TOKEN cannot create check runs
+# from forks (Resource not accessible by integration / 403).
 on:
   - pull_request
 
@@ -40,7 +41,11 @@ jobs:
         shell: bash
         run: sqlfluff lint --format github-annotation --annotation-level failure --nofail ${{ steps.get_files_to_lint.outputs.lintees }} > annotations.json
       - name: Annotate
-        if: steps.get_files_to_lint.outputs.lintees != ''
+        # Same-repo PRs only: fork tokens get 403 creating check runs, and
+        # ignore-unauthorized-error does not treat that as unauthorized.
+        if: >
+          steps.get_files_to_lint.outputs.lintees != '' &&
+          github.event.pull_request.head.repo.full_name == github.repository
         uses: yuzutech/annotations-action@v0.6.0
         with:
           repo-token: "${{ secrets.GITHUB_TOKEN }}"