Merge pull request #19 from ruivieira/update-gha

ci(workflow): run image build action only on upstream

Author: ruivieira

.github/workflows/push-server-image.yml

@@ -8,14 +8,15 @@ on:
     paths:
       - 'nemoguardrails/*'
       - '.github/workflows/*'
-  pull_request_target:
+  pull_request:
     paths:
       - 'nemoguardrails/*'
       - '.github/workflows/*'
     types: [labeled, opened, synchronize, reopened]
   workflow_dispatch:
 jobs:
   build-and-push-ci:
+    if: github.repository == 'trustyai-explainability/NeMo-Guardrails'
     runs-on: ubuntu-latest
     permissions:
       contents: read
@@ -47,12 +48,15 @@ jobs:
           mode: minimum
           count: 1
           labels: "ok-to-test, lgtm, approved"
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
         if: env.BUILD_CONTEXT == 'ci'
         with:
           ref: ${{ github.event.pull_request.head.sha }}
-      - uses: actions/checkout@v3
+          persist-credentials: false
+      - uses: actions/checkout@v4
         if: env.BUILD_CONTEXT == 'main' ||  env.BUILD_CONTEXT == 'tag'
+        with:
+          persist-credentials: false
       # Set environments depending on context
       - name: Set CI environment
         if:  env.BUILD_CONTEXT == 'ci'