CI: only run once for PRs with branches from original repo (#7075)

.github/workflows/ci.yaml

@@ -3,6 +3,7 @@ name: Build Hyprland
 on: [push, pull_request, workflow_dispatch]
 jobs:
   gcc:
+    if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.fork
     name: "Build Hyprland (Arch)"
     runs-on: ubuntu-latest
     container:
@@ -44,6 +45,7 @@ jobs:
           path: Hyprland.tar.xz
 
   meson:
+    if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.fork
     name: "Build Hyprland with Meson (Arch)"
     runs-on: ubuntu-latest
     container:
@@ -64,6 +66,7 @@ jobs:
         run: ninja -C build
 
   no-pch:
+    if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.fork
     name: "Build Hyprland without precompiled headers (Arch)"
     runs-on: ubuntu-latest
     container:
@@ -83,6 +86,7 @@ jobs:
         run: make nopch
 
   noxwayland:
+    if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.fork
     name: "Build Hyprland in pure Wayland (Arch)"
     runs-on: ubuntu-latest
     container:
@@ -103,6 +107,7 @@ jobs:
         run: make release
 
   clang-format:
+    if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.fork
     name: "Code Style (Arch)"
     runs-on: ubuntu-latest
     container:

.github/workflows/nix-ci.yml

@@ -9,7 +9,7 @@ jobs:
     secrets: inherit
 
   build:
-    if: always() && !cancelled() && !contains(needs.*.result, 'failure')
+    if: (github.event_name != 'pull_request' || github.event.pull_request.head.repo.fork) && !contains(needs.*.result, 'failure')
     needs: update-inputs
     uses: ./.github/workflows/nix-build.yml
     secrets: inherit

.github/workflows/security-checks.yml

@@ -4,6 +4,7 @@ on: [push, pull_request]
 
 jobs:
   flawfinder:
+    if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.fork
     name: Flawfinder Checks
     runs-on: ubuntu-latest
     permissions: