fix(ci): update release-please workflow with stricter repo validation

- Add conditions to validate the head repository matches the current repository.
- Explicitly specify secrets for RELEASE_PLEASE_APP_ID and RELEASE_PLEASE_APP_PRIVATE_KEY.

fix(test): adjust account meta test to use getFirst()

- Replace `get(0)` with `getFirst()` for improved clarity and correctness.

Author: jpe7s

.github/workflows/release-please.yml

@@ -18,6 +18,8 @@ permissions:
 
 jobs:
   release-please:
-    if: ${{ github.event.workflow_run.conclusion == 'success' }}
+    if: ${{ github.event.workflow_run.conclusion == 'success' && github.event.workflow_run.head_repository.full_name == github.repository }}
     uses: sava-software/sava-build/.github/workflows/release-please.yml@main
-    secrets: inherit
+    secrets:
+      RELEASE_PLEASE_APP_ID: ${{ secrets.RELEASE_PLEASE_APP_ID }}
+      RELEASE_PLEASE_APP_PRIVATE_KEY: ${{ secrets.RELEASE_PLEASE_APP_PRIVATE_KEY }}

ix-proxy/src/test/java/systems/glam/ix/proxy/IxMapperTest.java

@@ -656,7 +656,7 @@ void shouldUseStagingVaultPdaWhenStaging() {
     );
 
     final var result = fixSignerAccounts(ix, glamState, glamSigner, true);
-    expectAccountMeta(result.accounts().get(0), glamSigner, true, false);
+    expectAccountMeta(result.accounts().getFirst(), glamSigner, true, false);
   }
 
   // ===== PDA utilities =====