Only run publish GH action for apache repo, not forked

[kevinjqliu]

The Publish Snapshot to Maven Github Action has been scheduled automatically in my forked repo and failing due to permission issues.

Log:

* What went wrong:
120
Execution failed for task ':iceberg-spark:publishApachePublicationToMavenRepository'.
121
> Failed to publish publication 'apache' to repository 'maven'
122
   > Could not PUT 'https://repository.apache.org/content/repositories/snapshots/org/apache/iceberg/iceberg-spark/0.13.0-SNAPSHOT/maven-metadata.xml'. Received status code 401 from server: Unauthorized
123

Example GH Action run

The GH Action retries automatically (every day?) and will also generate a failure email report. I had to manually disable it on my forked repo.
This PR limits the GH Action to run only on the apache repo.

References:

• Do not run GitHub Action Workflows on fork of example repository #3539
• No update-precommit on forks #5261
• Modify Github Action to only run on repo's owned by 'smaddis' #33
• Stop github actions running on a fork

[kbendick]

This is a good catch. Thank you @kevinjqliu!

cc @nastra who authored this action. Do you have the need to be able to run this action in your fork (where editing this out and pushing it into your fork's master branch wouldn't be a viable work around)?

EDIT: Also, this might be somewhat urgent if somebody's fork does have permissions (which would be surprising but you never know).

[kevinjqliu]

I merged this change to my own fork. Seems like it runs on 0 UTC, will report back tmr

[nastra]

This is a good catch. Thank you @kevinjqliu!

cc @nastra who authored this action. Do you have the need to be able to run this action in your fork (where editing this out and pushing it into your fork's master branch wouldn't be a viable work around)?

EDIT: Also, this might be somewhat urgent if somebody's fork does have permissions (which would be surprising but you never know).

@kbendick no I don't need to have this enabled in my own fork, so let's get this merged. @kevinjqliu thanks for bringing this up.

[kbendick]

This is a good catch. Thank you @kevinjqliu!
cc @nastra who authored this action. Do you have the need to be able to run this action in your fork (where editing this out and pushing it into your fork's master branch wouldn't be a viable work around)?
EDIT: Also, this might be somewhat urgent if somebody's fork does have permissions (which would be surprising but you never know).

@kbendick no I don't need to have this enabled in my own fork, so let's get this merged. @kevinjqliu thanks for bringing this up.

Agreed let’s get this merged ASAP. Feel free to ask @rymurr to merge this since y’all are up. If he’s not available. I’m OOO for much of the day tomorrow but I’ll ask somebody in me timezone otherwise. This seems pretty important.

We should also consider locking down the permissions of this particular job (and eventually all of them). Take a look at the labeler workflow that I added permissions to a while back @nastra.

[openinx]

@rymurr , One small piece of advice: Pls check if the commit message are formatted like Build: xxxx before merge PR (if possible).

[rdblue]

Thanks, @rymurr for merging! Good to see you again.