ci: skip cloud tests for external pull requests

Author: hln33

.github/workflows/cloud-tests.yml

@@ -24,6 +24,9 @@ permissions:
 jobs:
   example-tests:
     name: example-tests (${{ matrix.python-version }})
+    # 1. Run for non-PR events, such as scheduled runs and manual invocations
+    # 2. For PRs, run only same-repo branches from non-Dependabot actors; forked PRs or Dependabot should not access secrets.
+    if: github.event_name != 'pull_request' || (github.actor != 'dependabot[bot]' && github.event.pull_request.head.repo.full_name == github.repository)
     runs-on: ubuntu-latest
     permissions:
       contents: read

.github/workflows/conformance-tests.yml

@@ -39,6 +39,9 @@ permissions:
 jobs:
   discover_suites:
     name: discover conformance suites
+    # 1. Run for non-PR events, such as scheduled runs and manual invocations
+    # 2. For PRs, run only same-repo branches from non-Dependabot actors; forked PRs or Dependabot should not access secrets.
+    if: github.event_name != 'pull_request' || (github.actor != 'dependabot[bot]' && github.event.pull_request.head.repo.full_name == github.repository)
     runs-on: ubuntu-latest
     outputs:
       suites: ${{ steps.discover.outputs.suites }}

.github/workflows/opentelemetry-conformance-tests.yml

@@ -52,6 +52,9 @@ permissions: {}
 
 jobs:
   opentelemetry:
+    # 1. Run for non-PR events, such as scheduled runs and manual invocations
+    # 2. For PRs, run only same-repo branches from non-Dependabot actors; forked PRs or Dependabot should not access secrets.
+    if: github.event_name != 'pull_request' || (github.actor != 'dependabot[bot]' && github.event.pull_request.head.repo.full_name == github.repository)
     permissions:
       actions: write
       contents: read