ci: make the workflows safe to run in the internal repo

.github/workflows/codeql.yml

@@ -11,6 +11,8 @@ on:
 jobs:
   analyze:
     name: Analyze (${{ matrix.language }})
+    # Code scanning in the internal repo would need GitHub Code Security.
+    if: github.repository == 'stellar/stellar-rpc'
     # Pinned to the Build matrix image so the cgo libs build the same and share its cache.
     runs-on: ubuntu-24.04
     timeout-minutes: 360

.github/workflows/integration-tests.yml

@@ -8,7 +8,7 @@ on:
   workflow_call:
     inputs:
       rpc_git_ref:
-        description: 'Git ref (branch, tag, or SHA) of stellar/stellar-rpc to run tests on. Required when running from separate repo, branch tip otherwise.'
+        description: 'Git ref (branch, tag, or SHA) of the repo that holds this workflow to run tests on. Required when running from separate repo, branch tip otherwise.'
         required: false
         type: string
       protocol_version:
@@ -51,8 +51,9 @@ jobs:
       - uses: actions/checkout@v4
         with:
           # Because this is a callable workflow, we need to explicitly specify the repo, since otherwise
-          # it will check out the caller's repo.
-          repository: stellar/stellar-rpc
+          # it will check out the caller's repo. This is the repo that holds this workflow, so
+          # stellar-rpc's internal repo tests its own commits.
+          repository: ${{ job.workflow_repository }}
           # For pull requests, build and test the PR head not a merge of the PR with the destination.
           ref: ${{ env.RPC_GIT_REF || github.event.pull_request.head.sha || github.ref }}
           # We need to full history for git-restore-mtime to know what modification dates to use.

.github/workflows/load-test-coordinator.yml

@@ -40,6 +40,8 @@ permissions:
 jobs:
   plan:
     name: Resolve release context
+    # The legs assume an AWS role that trusts only this repo, so the internal repo can't load test.
+    if: github.repository == 'stellar/stellar-rpc'
     runs-on: ubuntu-latest
     timeout-minutes: 5
     outputs:
@@ -147,7 +149,7 @@ jobs:
   report:
     name: Aggregate + report
     needs: [plan, load-test, backfill, blaster]
-    if: ${{ !cancelled() }}
+    if: ${{ !cancelled() && github.repository == 'stellar/stellar-rpc' }}
     runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:

.github/workflows/socket-basics.yml

@@ -19,6 +19,8 @@ permissions:
 
 jobs:
   socket-basics:
+    # Scans of the internal repo would send Socket results for unreleased fixes.
+    if: github.repository == 'stellar/stellar-rpc'
     runs-on: ubuntu-latest
     timeout-minutes: 30
     steps:

.github/workflows/socket-scan.yml

@@ -35,6 +35,8 @@ permissions:
 
 jobs:
   socket-scan:
+    # Scans of the internal repo would send Socket results for unreleased fixes.
+    if: github.repository == 'stellar/stellar-rpc'
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3

.github/workflows/update-completed-sprint-on-issue-closed.yml

@@ -8,6 +8,8 @@ on:
 
 jobs:
   update-completed-sprint:
+    # The internal repo doesn't have the project app's secrets.
+    if: github.repository == 'stellar/stellar-rpc'
     runs-on: ubuntu-latest
     steps:
       - name: Generate token

.github/workflows/update-soroban-env.yml

@@ -20,6 +20,8 @@ permissions:
 jobs:
   update-soroban-env-curr:
     name: "Update soroban-env curr deps to latest tip"
+    # The bump PRs belong in this repo. The internal repo gets them when it syncs.
+    if: github.repository == 'stellar/stellar-rpc'
     runs-on: ubuntu-latest
     env:
       BASE_BRANCH: protocol-next