fix: skip publish workflows on forks

[jarrensj]

Change description

Fixes #1624. Pushes to master on forks trigger the Publish and Release workflows, which fail without DockerHub/registry credentials and spam fork owners with failure emails on every upstream sync.

This adds if: ${{ !github.event.repository.fork }} to the single job in docker-build-and-push.yml and release.yml, so they only run in the upstream repo. Both workflows only trigger on push events, whose payload always includes the repository.fork flag, and using the flag (rather than a hardcoded repo name) keeps the guard working even if the repo is ever renamed or moved. nix-environment.yml is intentionally left unguarded: it needs no credentials and forks may want that build check.

How to test: push any commit to master on a fork — the Publish and Release workflows should show as skipped instead of failing.

AI coding assistance disclosure

I used Claude Code to identify the affected workflows and prepare the change. I reviewed the diff myself.

Contributor check list

• I have written a description of the contribution and explained its motivation.
• I have written tests for my code changes (if applicable). (N/A — CI configuration change.)
• I have read and understood the AI Assisted Contribution guidelines.
• I will own this change in production, and I am prepared to fix any bugs caused by my code change.

[FallenDeity]

thanks for this pr lol 😄 i used to get a failed mail everytime syncing my fork ;-; never got around to it

how about using the github context env var for the fork check instead of a hardcode that would be more robust imo github.event.repository.fork

and the event payload contains a repository object

• repository has a fork attribute: https://docs.github.com/en/rest/repos/repos?apiVersion=2026-03-10#get-a-repository

so something like this should work if: ${{ !github.event.repository.fork }}

[jarrensj]

thanks for this pr lol 😄 i used to get a failed mail everytime syncing my fork ;-; never got around to it

how about using the github context env var for the fork check instead of a hardcode that would be more robust imo github.event.repository.fork

and the event payload contains a repository object

• repository has a fork attribute: https://docs.github.com/en/rest/repos/repos?apiVersion=2026-03-10#get-a-repository

so something like this should work if: ${{ !github.event.repository.fork }}

No problem! Good idea, that's more robust. Just pushed the change!

[FallenDeity]

on a side note are you sure it was since that #1553 pr because that is a bit weird since I did not change the branch condition in that pr, it has been triggering for me quite a while

publish one has been there for a while

release workflow seems to be from this commit 3db9c2c

ps: looks like static checks is failing because of missing newline at end of nix file due to the recently merged #1602 which was modified in an older pr but recently merged #1583 (running pre-commit run --all-files should fix it)