ci: run build-test-push on all PRs and fix ghcr push auth

Fork PRs previously skipped the build-test-push job entirely,
preventing contributors from getting build and test feedback.

The GHCR push step used || between independent secrets:
BOT_TOKEN || GITHUB_TOKEN and BOT_LOGIN || repository_owner.
When only one BOT_* secret was set, credentials became a mismatched
pair, causing a denied: denied authentication failure from ghcr.io.

Changes:
- Remove same-repo restriction from job condition so all PRs
  run the pipeline.
- Use && to ensure both BOT_TOKEN and BOT_LOGIN must exist
  together to be used; otherwise fall back to the always-
  available GITHUB_TOKEN + github.repository_owner pair.
- Expose BOT_TOKEN and BOT_LOGIN as env vars so they can be
  evaluated in the if: condition.
- Allow GHCR push on fork PRs when bot credentials are
  available; skip only when GITHUB_TOKEN would be read-only
  (fork PR without BOT_TOKEN/BOT_LOGIN).
- Use github.repository_owner as fallback username instead of
  github.actor to avoid confusion in org fork scenarios.

Author: yajo

.github/workflows/ci.yaml

@@ -25,7 +25,7 @@ jobs:
       - uses: pre-commit/action@v1.0.1
 
   build-test-push:
-    if: github.ref == format('refs/heads/{0}', github.event.repository.default_branch) || (github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository)
+    if: github.ref == format('refs/heads/{0}', github.event.repository.default_branch) || github.event_name == 'pull_request'
     runs-on: ubuntu-latest
     needs: pre-commit
     permissions:
@@ -62,6 +62,8 @@ jobs:
       # Github does not allow evaluating a secret in an if condition, so we need to set them as environment variables
       DOCKERHUB_TOKEN: ${{ secrets.DOCKERHUB_TOKEN }}
       DOCKERHUB_LOGIN: ${{ secrets.DOCKERHUB_LOGIN }}
+      BOT_TOKEN: ${{ secrets.BOT_TOKEN }}
+      BOT_LOGIN: ${{ secrets.BOT_LOGIN }}
     steps:
       # Image repo names have to be lowercase.
       - name: Lowercase image repository name
@@ -98,8 +100,9 @@ jobs:
           REGISTRY_USERNAME: ${{ env.DOCKERHUB_LOGIN }}
         run: ./hooks/push
       - name: Push Docker Image to GitHub Registry
+        if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository || env.BOT_TOKEN && env.BOT_LOGIN
         env:
           REGISTRY_HOST: ghcr.io
-          REGISTRY_TOKEN: ${{ secrets.BOT_TOKEN || secrets.GITHUB_TOKEN }}
-          REGISTRY_USERNAME: ${{ secrets.BOT_LOGIN || github.repository_owner }}
+          REGISTRY_TOKEN: ${{ secrets.BOT_LOGIN && secrets.BOT_TOKEN || secrets.GITHUB_TOKEN }}
+          REGISTRY_USERNAME: ${{ secrets.BOT_TOKEN && secrets.BOT_LOGIN || github.repository_owner }}
         run: ./hooks/push