ci: skip Supabase cache update on forks

Forks don't inherit SUPABASE_URL / SUPABASE_SERVICE_KEY secrets, so the
update-cache job was failing on every push to a fork's main branch.
Add a github.repository check so only the canonical upstream repo runs
the cache update; the pytest validate job still runs everywhere as a
sanity check.

Author: Shlok

.github/workflows/deploy-data.yml

@@ -46,10 +46,13 @@ jobs:
         run: pytest tests/ -v
 
   # ── Job 2: Update Supabase cache ─────────────────────────────────
-  # Runs only after validation passes. Skipped on pull requests.
+  # Runs only after validation passes. Skipped on pull requests AND on
+  # forks — forks don't inherit the SUPABASE_URL / SUPABASE_SERVICE_KEY
+  # secrets, so the import would fail. Only the canonical upstream repo
+  # is allowed to write to the production / staging Supabase project.
   update-cache:
     needs: validate
-    if: github.event_name != 'pull_request'
+    if: github.event_name != 'pull_request' && github.repository == 'path-avmap/av-map-data'
     runs-on: ubuntu-latest
 
     steps: