ci: Prevent workflows from running unnecessarily on forks (#5127)

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: Jason3S <3740137+Jason3S@users.noreply.github.com>

Author: Copilot

.github/workflows/codeql-analysis.yml

@@ -21,6 +21,7 @@ jobs:
     #   - https://gh.io/supported-runners-and-hardware-resources
     #   - https://gh.io/using-larger-runners
     # Consider using larger runners for possible analysis time improvements.
+    if: github.repository_owner == 'streetsidesoftware'
     runs-on: 'ubuntu-latest'
     timeout-minutes: 360
     permissions:

.github/workflows/deploy-website.yml

@@ -18,6 +18,7 @@ permissions:
 jobs:
   build:
     name: Build Docusaurus
+    if: github.repository_owner == 'streetsidesoftware'
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v6

.github/workflows/issues-lock.yml

@@ -7,7 +7,10 @@ on:
 
 jobs:
   stale:
+    if: github.repository_owner == 'streetsidesoftware'
     runs-on: ubuntu-latest
+    permissions:
+      issues: write
     steps:
       - uses: dessant/lock-threads@v6.0.0
         with:

.github/workflows/manual-publish.yml

@@ -25,7 +25,10 @@ on:
 # A workflow run is made up of one or more jobs that can run sequentially or in parallel
 jobs:
   check_version:
+    if: github.repository_owner == 'streetsidesoftware'
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     outputs:
       version: ${{ steps.version.outputs.version }}
       alpha: ${{ steps.version.outputs.alpha }}

.github/workflows/release-assets.yml

@@ -33,6 +33,7 @@ permissions:
 jobs:
   build:
     name: Upload Assets
+    if: github.repository_owner == 'streetsidesoftware'
     env:
       REF: ${{ inputs.ref || github.ref }}
     runs-on: ubuntu-latest

.github/workflows/release-mark-prerelease.yml

@@ -33,6 +33,7 @@ permissions:
 jobs:
   UpdateRelease:
     name: Mark Release
+    if: github.repository_owner == 'streetsidesoftware'
     env:
       REF: ${{ inputs.ref || github.ref }}
     runs-on: ubuntu-latest

.github/workflows/release-notes.yml

@@ -35,6 +35,7 @@ permissions:
 jobs:
   build:
     name: Update Release Notes
+    if: github.repository_owner == 'streetsidesoftware'
     env:
       REF: ${{ inputs.ref || github.ref }}
     runs-on: ubuntu-latest

.github/workflows/release-please.yml

@@ -18,6 +18,7 @@ permissions:
 
 jobs:
   release-please:
+    if: github.repository_owner == 'streetsidesoftware'
     runs-on: ubuntu-latest
     outputs:
       release_created: ${{ steps.release.outputs.release_created }}

.github/workflows/set-prerelease.yml

@@ -13,6 +13,7 @@ permissions:
   pull-requests: write
 jobs:
   set-prerelease-mode:
+    if: github.repository_owner == 'streetsidesoftware'
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v6