ci: add repository guards to workflow files (#364)

* ci: 每30分钟自动同步上游仓库

* ci: add repository guards to workflow files

- python-publish.yml: only run on OpenWSGR/AutoWSGR (upstream)
- lunar.yml: only run on OpenWSGR/AutoWSGR (upstream)
- sync-upstream.yml: re-add with fork-only guard (skip on upstream)

This prevents publish from running on forks (missing PYPI_API_TOKEN)
and keeps the sync workflow from running on the upstream repo.

---------

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

Author: yltx

.github/workflows/lunar.yml

@@ -10,6 +10,7 @@ on:
 
 jobs:
   test:
+    if: github.repository == 'OpenWSGR/AutoWSGR'
     runs-on: ubuntu-latest
     steps:
       - uses: 0xWelt/Lunar@main

.github/workflows/python-publish.yml

@@ -19,6 +19,7 @@ permissions:
 
 jobs:
   deploy:
+    if: github.repository == 'OpenWSGR/AutoWSGR'
     runs-on: ubuntu-latest
     steps:
     - uses: actions/checkout@v6

.github/workflows/sync-upstream.yml

@@ -0,0 +1,19 @@
+name: Sync upstream
+
+on:
+  schedule:
+    - cron: '0 */6 * * *'   # 每 6 小时检测上游新提交
+  workflow_dispatch:         # 也可手动触发
+
+permissions:
+  contents: write
+
+jobs:
+  sync:
+    if: github.repository != 'OpenWSGR/AutoWSGR'
+    runs-on: ubuntu-latest
+    steps:
+      - name: Sync fork with upstream
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: gh repo sync ${{ github.repository }} --force