Merge pull request #1747 from cfengine/ENT-13038/3.21

Restrict workflow runs to cfengine organization pull requests (3.21)

Author: craigcomstock

.github/workflows/ci.yml

@@ -1,11 +1,11 @@
 name: Continuous Integration
 
-# Run this CI on all pushes to upstream
-# (including PRs fromm usptream to upstream)
-on: push
+on: pull_request
 
 jobs:
   build_cfengine_hub_package:
+    # this job only works when submitted from the cfengine organization aka upstream to upstream pull requests: ENT-13038
+    if: github.event.organization.login == 'cfengine'
     uses: ./.github/workflows/build-using-buildscripts.yml
     secrets: inherit