ci: add skip publish on fork pr builds

.github/workflows/build-publish-container-goreleaser.yml

@@ -49,7 +49,17 @@ jobs:
           driver-opts: |
             image=moby/buildkit:master
             network=host
+      - name: Check if fork PR
+        run: |
+          if [[ "${{ github.event_name }}" == "pull_request" && \
+                "${{ github.event.pull_request.head.repo.full_name }}" != "${{ github.repository }}" ]]; then
+            echo "SKIP_CONTAINER_PUBLISH=true" >> "${GITHUB_ENV}"
+            echo "::warning title=Fork PR - Container Publish Skipped::Containers will be built but not published for fork PRs due to GitHub security restrictions."
+          else
+            echo "SKIP_CONTAINER_PUBLISH=false" >> "${GITHUB_ENV}"
+          fi
       - name: Docker Login
+        if: env.SKIP_CONTAINER_PUBLISH == 'false'
         uses: docker/login-action@v3
         with:
           registry: ghcr.io
@@ -88,9 +98,10 @@ jobs:
           GITHUB_TOKEN: ${{ github.token }}
         with:
           version: '~> 2'
-          args: release --clean ${{ inputs.is_pr_build && '--skip=announce,validate,archive' || '' }}
+          args: release --clean ${{ inputs.is_pr_build && '--skip=announce,validate,archive' || '' }}${{ env.SKIP_CONTAINER_PUBLISH == 'true' && (inputs.is_pr_build && ',publish' || '--skip=publish') || '' }}
         id: goreleaser
       - name: Process goreleaser output
+        if: env.SKIP_CONTAINER_PUBLISH == 'false'
         id: process_goreleaser_output
         run: |
           node - <<'EOF'
@@ -102,10 +113,12 @@ jobs:
           EOF
           echo "digest=$(cat digest.txt)" >> "${GITHUB_OUTPUT}"
       - name: Attest Binaries
+        if: ${{ (env.SKIP_CONTAINER_PUBLISH == 'false') && (inputs.is_pr_build == false) }}
         uses: actions/attest-build-provenance@v4.1.0
         with:
           subject-path: dist/**
       - name: generate build provenance
+        if: ${{ (env.SKIP_CONTAINER_PUBLISH == 'false') && (inputs.is_pr_build == false) }}
         uses: actions/attest-build-provenance@v4.1.0
         with:
           subject-name: ${{ inputs.registry_subject_name }}