build: skip GitHub action steps the require write perms on external PRs

... so that checks can pass when people submit PRs to the repo.

.github/workflows/build-core.yml

@@ -39,28 +39,29 @@ jobs:
       # Test results report
       - name: Report test results
         uses: dorny/test-reporter@v1
-        if: success() || failure()
+        if: success() || failure() && github.event.pull_request.head.repo.full_name == github.repository
         with:
           name: Mocha tests
           path: test-results.json
           reporter: mocha-json
 
       - name: Report code coverage
-        if: ${{ github.event_name == 'pull_request' }}
+        if: github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository
         uses: romeovs/[email protected]
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}
           lcov-file: ./coverage/lcov.info
 
       - name: Check code coverage threshold
         uses: VeryGoodOpenSource/very_good_coverage@v2
+        if: github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository
         with:
           path: ./coverage/lcov.info
           min_coverage: 50
 
       # Build and push container image to GCR (only on main branch)
       - name: Log in to the GitHub Container Registry
-        if: ${{ github.ref == 'refs/heads/main' }}
+        if: github.ref == 'refs/heads/main'
         uses: docker/login-action@v1
         with:
           registry: ghcr.io
@@ -78,6 +79,7 @@ jobs:
 
       # Build and push container image to ECR
       - name: Configure AWS credentials
+        if: ${{ github.event_name != 'pull_request' }}
         uses: aws-actions/configure-aws-credentials@v2
         with:
           role-to-assume: arn:aws:iam::${{ secrets.AWS_ACCOUNT_ID }}:role/${{ secrets.AWS_BUILD_INVOCATION_ROLE }}
@@ -107,15 +109,15 @@ jobs:
 
       # Success notification
       - name: Send Slack success notification
-        if: success()
+        if: success() && ${{ github.event_name != 'pull_request' }}
         env:
           SLACK_TITLE: Build succeeded!
           SLACK_WEBHOOK: ${{ secrets.SLACK_WEBHOOK }}
         uses: rtCamp/action-slack-notify@v2
 
       # Failure notification
       - name: Send Slack failure notification
-        if: failure()
+        if: failure() && ${{ github.event_name != 'pull_request' }}
         env:
           SLACK_TITLE: Build failed!
           SLACK_COLOR: danger