security: block fork PRs from running on the self-hosted runner (#10)

Jobs triggered on pull_request that run on the self-hosted runner could
execute untrusted fork PR code on the runner host. Add an if: guard so
these jobs run only for same-repo events (push, schedule, workflow_dispatch,
and PRs from branches in this repo), never for fork PRs. Runner stays
self-hosted for trusted runs.

Co-authored-by: GeiserX <drumsergio@gmail.com>

Author: GeiserX

.github/workflows/main.yml

@@ -7,6 +7,10 @@ on:
 jobs:
   lint:
     runs-on: [self-hosted, Linux, X64]
+    # Do not run untrusted fork PR code on the self-hosted runner.
+    if: >-
+      github.event_name != 'pull_request' ||
+      github.event.pull_request.head.repo.full_name == github.repository
     steps:
       - uses: actions/checkout@v6
       - uses: GeiserX/awesome-lint-extra@v1.1.0
@@ -16,6 +20,10 @@ jobs:
           check_alphabetical: 'true'
   links:
     runs-on: [self-hosted, Linux, X64]
+    # Do not run untrusted fork PR code on the self-hosted runner.
+    if: >-
+      github.event_name != 'pull_request' ||
+      github.event.pull_request.head.repo.full_name == github.repository
     continue-on-error: true
     steps:
       - uses: actions/checkout@v6