Merge pull request #119 from iblai/ci/oss-prep-cleanup

ci: remove stale workflows and skip CI for external PRs

Author: bnsoni

.github/workflows/e2e-coverage-bot.yml

@@ -34,8 +34,12 @@ jobs:
   coverage-bot:
     name: E2E Coverage Bot
     runs-on: ubuntu-latest
-    # Skip commits made by the bot itself (prevent loops) and Dependabot PRs (no secret access)
-    if: github.actor != 'mamigot' && github.actor != 'dependabot[bot]'
+    # Skip commits made by the bot itself (prevent loops), Dependabot PRs (no secret
+    # access), and PRs opened from forks (no secret access either).
+    if: |
+      github.actor != 'mamigot' &&
+      github.actor != 'dependabot[bot]' &&
+      github.event.pull_request.head.repo.full_name == github.repository
     permissions:
       contents: write # allow Claude to commit coverage file updates
       pull-requests: write # allow gh pr review to post reviews

.github/workflows/pr-e2e-tests.yml

@@ -38,7 +38,9 @@ jobs:
   # GATE — only run when the `run-tests` label is present
   # ============================================================
   gate:
-    if: contains(github.event.pull_request.labels.*.name, 'run-tests')
+    if: |
+      contains(github.event.pull_request.labels.*.name, 'run-tests') &&
+      github.event.pull_request.head.repo.full_name == github.repository
     runs-on: iblai-stg-runner
     steps:
       - run: echo "run-tests label detected — proceeding"
@@ -106,7 +108,7 @@ jobs:
   summary:
     needs: [build-playwright-image, build-app-image, run-tests]
     if: always()
-    runs-on: iblai-stg-runner
+    runs-on: ubuntu-latest
     steps:
       - name: Results
         run: |