Restrict remaining public automation to the NVIDIA organization

.github/workflows/ci.yml

@@ -28,6 +28,7 @@ on:
 
 jobs:
   ci-vars:
+    if: ${{ github.repository_owner == 'nvidia' }}
     runs-on: ubuntu-latest
     outputs:
       CUDA_BUILD_VER: ${{ steps.get-vars.outputs.cuda_build_ver }}
@@ -47,6 +48,7 @@ jobs:
           echo "cuda_prev_build_ver=$cuda_prev_build_ver" >> $GITHUB_OUTPUT
 
   should-skip:
+    if: ${{ github.repository_owner == 'nvidia' }}
     runs-on: ubuntu-latest
     outputs:
       skip: ${{ steps.get-should-skip.outputs.skip }}
@@ -89,6 +91,7 @@ jobs:
   # unconditionally run everything because there is no meaningful "changed
   # paths" baseline for those events.
   detect-changes:
+    if: ${{ github.repository_owner == 'nvidia' }}
     runs-on: ubuntu-latest
     outputs:
       bindings: ${{ steps.compose.outputs.bindings }}
@@ -535,7 +538,7 @@ jobs:
 
   checks:
     name: Check job status
-    if: always()
+    if: ${{ always() && github.repository_owner == 'nvidia' }}
     runs-on: ubuntu-latest
     needs:
       - should-skip

.github/workflows/coverage.yml

@@ -17,6 +17,7 @@ env:
 
 jobs:
   coverage-vars:
+    if: ${{ github.repository_owner == 'nvidia' }}
     runs-on: ubuntu-latest
     outputs:
       CUDA_VER: ${{ steps.get-vars.outputs.cuda_ver }}
@@ -467,7 +468,7 @@ jobs:
     name: Combine Coverage and Deploy
     needs: [coverage-linux, coverage-windows]
     runs-on: ubuntu-latest
-    if: always()
+    if: ${{ always() && github.repository_owner == 'nvidia' }}
     permissions:
       id-token: write
       contents: write

.github/workflows/release-cuda-pathfinder.yml

@@ -33,6 +33,7 @@ jobs:
   # Collect release metadata, find the CI run, create a draft release.
   # --------------------------------------------------------------------------
   prepare:
+    if: ${{ github.repository_owner == 'nvidia' }}
     runs-on: ubuntu-latest
     permissions:
       contents: write

.github/workflows/release.yml

@@ -76,6 +76,7 @@ defaults:
 
 jobs:
   determine-run-id:
+    if: ${{ github.repository_owner == 'nvidia' }}
     runs-on: ubuntu-latest
     outputs:
       run-id: ${{ steps.lookup-run-id.outputs.run-id }}
@@ -103,6 +104,7 @@ jobs:
           echo "run-id=$RUN_ID" >> "$GITHUB_OUTPUT"
 
   check-tag:
+    if: ${{ github.repository_owner == 'nvidia' }}
     runs-on: ubuntu-latest
     steps:
       - name: Checkout Source
@@ -154,6 +156,7 @@ jobs:
           fi
 
   check-release-notes:
+    if: ${{ github.repository_owner == 'nvidia' }}
     runs-on: ubuntu-latest
     steps:
       - name: Checkout Source

.github/workflows/triagelabel.yml

@@ -12,6 +12,7 @@ on:
 
 jobs:
   triage:
+    if: ${{ github.repository_owner == 'nvidia' }}
     runs-on: ubuntu-latest
     permissions:
       issues: write