ci: skip GH Pages publish from fork PRs

Author: cwillisf

.github/workflows/ci.yml

@@ -89,7 +89,18 @@ jobs:
   preview:
     runs-on: ubuntu-latest
     needs: build
-    if: ${{ needs.build.outputs.any-workspace == 'true' }}
+    # We don't want to give forks free reign to publish to our GH Pages, so run this job only if both:
+    # - any workspace changed (otherwise there's no work to do)
+    # - and either
+    #   - this is not a PR (so it's some other event that happened in our fork, like a push or merge group)
+    #   - or it's a PR from our fork (not some other fork)
+    if: ${{
+        (needs.build.outputs.any-workspace == 'true') &&
+        (
+          (!github.event.pull_request) ||
+          (github.event.pull_request.head.repo.full_name == github.repository)
+        )
+      }}
     name: Publish preview playgrounds to GH Pages
     steps:
       - name: Determine GitHub Pages directory name