ci: gate workflow to GitHub Actions only, skip on Gitea mirror

.github/workflows/ci.yml

@@ -23,6 +23,10 @@ env:
 jobs:
   test:
     name: mix precommit
+    # GitHub-only: this pipeline targets GitHub Actions (Harbor publish, Trivy,
+    # Cosign). Gitea's runner reports its own host as github.server_url, so the
+    # whole workflow no-ops on the Gitea mirror.
+    if: github.server_url == 'https://github.com'
     runs-on: ubuntu-latest
     timeout-minutes: 15
     services:
@@ -77,7 +81,7 @@ jobs:
   # can change without touching Settings.
   ci-ok:
     name: All checks passed
-    if: always()
+    if: always() && github.server_url == 'https://github.com'
     needs: [test]
     runs-on: ubuntu-latest
     timeout-minutes: 1
@@ -96,7 +100,7 @@ jobs:
     name: Build and push to Harbor
     runs-on: ubuntu-latest
     timeout-minutes: 30
-    if: github.event_name == 'push'
+    if: github.event_name == 'push' && github.server_url == 'https://github.com'
     needs: [test]
     permissions:
       contents: read