selftest: restrict to non-PRs and PRs on non-forks (#34)

* selftest: restrict to non-PRs and PRs on non-forks

Signed-off-by: William Woodruff <[email protected]>

* selftest: fix YAML

Signed-off-by: William Woodruff <[email protected]>

Signed-off-by: William Woodruff <[email protected]>

Author: woodruffw

.github/workflows/selftest.yml

@@ -13,6 +13,7 @@ permissions:
 jobs:
   selftest:
     runs-on: ubuntu-latest
+    if: (github.event_name != 'pull_request') || !github.event.pull_request.head.repo.fork
     steps:
       - uses: actions/checkout@v3
       - name: Sign artifact and publish signature
@@ -23,6 +24,7 @@ jobs:
 
   selftest-staging:
     runs-on: ubuntu-latest
+    if: (github.event_name != 'pull_request') || !github.event.pull_request.head.repo.fork
     steps:
       - uses: actions/checkout@v3
       - name: Sign artifact and publish signature
@@ -34,6 +36,7 @@ jobs:
 
   selftest-glob:
     runs-on: ubuntu-latest
+    if: (github.event_name != 'pull_request') || !github.event.pull_request.head.repo.fork
     steps:
       - uses: actions/checkout@v3
       - name: Sign artifacts and publish signatures
@@ -45,6 +48,7 @@ jobs:
 
   selftest-upload-artifacts:
     runs-on: ubuntu-latest
+    if: (github.event_name != 'pull_request') || !github.event.pull_request.head.repo.fork
     steps:
       - uses: actions/checkout@v3
       - name: Sign artifact and publish signature
@@ -57,6 +61,7 @@ jobs:
 
   selftest-custom-paths:
     runs-on: ubuntu-latest
+    if: (github.event_name != 'pull_request') || !github.event.pull_request.head.repo.fork
     steps:
       - uses: actions/checkout@v3
       - name: Sign artifact and publish signature
@@ -71,6 +76,7 @@ jobs:
   # NOTE(alex): `sigstore-python` doesn't support verifying URI SANs yet.
   # selftest-verify-san:
   #   runs-on: ubuntu-latest
+  #   if: (github.event_name != 'pull_request') || !github.event.pull_request.head.repo.fork
   #   steps:
   #     - uses: actions/checkout@v3
   #     - name: Sign artifact and publish signature
@@ -83,6 +89,7 @@ jobs:
 
   selftest-verify-issuer:
     runs-on: ubuntu-latest
+    if: (github.event_name != 'pull_request') || !github.event.pull_request.head.repo.fork
     steps:
       - uses: actions/checkout@v3
       - name: Sign artifact and publish signature
@@ -95,6 +102,7 @@ jobs:
 
   selftest-identity-token:
     runs-on: ubuntu-latest
+    if: (github.event_name != 'pull_request') || !github.event.pull_request.head.repo.fork
     steps:
       - uses: actions/checkout@v3
       - name: Get OIDC token