Skip Docker Hub login for forked PRs (#2629)

Forked PRs cannot access GitHub secrets (DOCKERHUB_USERNAME and
DOCKERHUB_TOKEN), causing the Docker login step to fail with 'Username
and password required'. This blocks external contributions.

This change makes the Docker Hub login conditional:
- Skips login for forked PRs (secrets unavailable)
- Runs login for PRs from branches in the main repo
- Runs login for push events, tags, and manual workflows

Docker Hub authentication helps avoid rate limits (429 errors) when
pulling base images like python:* and nvidia/cuda:* during builds.
Forked PRs will use anonymous Docker Hub pulls and may occasionally
hit rate limits, but this is an acceptable trade-off to unblock public
contributions.

Fixes the issue reported in PR #2619 where forked PRs fail at the
Docker login step in CI.

Co-authored-by: Mark Phelps <mphelps@cloudflare.com>

Author: markphelps

.github/workflows/ci.yaml

@@ -172,6 +172,8 @@ jobs:
           fetch-depth: 0
       - name: Login to Docker Hub
         uses: docker/login-action@v3
+        # Skip Docker Hub login for forked PRs (secrets not available)
+        if: github.event.pull_request.head.repo.full_name == github.repository || github.event_name != 'pull_request'
         with:
           registry: index.docker.io
           username: ${{ secrets.DOCKERHUB_USERNAME }}
@@ -219,6 +221,8 @@ jobs:
           fetch-depth: 0 # needed for goreleaser version determination
       - name: Login to Docker Hub
         uses: docker/login-action@v3
+        # Skip Docker Hub login for forked PRs (secrets not available)
+        if: github.event.pull_request.head.repo.full_name == github.repository || github.event_name != 'pull_request'
         with:
           registry: index.docker.io
           username: ${{ secrets.DOCKERHUB_USERNAME }}