CI: Avoid running on 'push' in mirrors / forks (#110063)

* CI: Avoid running on 'push' in mirrors / forks

* use single quotes

.github/workflows/reject-gh-secrets.yml

@@ -12,6 +12,8 @@ permissions: {}
 
 jobs:
   reject-gh-secrets:
+    # Run on `grafana/grafana` main branch, or on pull requests to prevent double-running on mirrors
+    if: (github.event_name == 'pull_request' || (github.event_name == 'push' && github.repository == 'grafana/grafana'))
     runs-on: ubuntu-latest
     permissions:
       contents: read
@@ -28,4 +30,4 @@ jobs:
             echo "Found secrets access in the codebase. Please remove it in favour of Vault secrets."
             echo "If you are sure this is correct, add '# nolint:reject-gh-secrets' to the end of the line. Be VERY careful with this."
             exit 1
-          fi
+          fi