Guard demo workflow artifact uploads on forked PRs

[MontrealAI]

Motivation

• Prevent failing artifact uploads and permission errors when demo workflows run for forked pull requests where the runner token lacks write permissions.
• Avoid attempting to publish artifacts from untrusted fork contexts by gating uploads to events that have a writable token.

Description

• Added an if guard (${{ always() && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.fork == false) }}) to actions/upload-artifact steps in demo workflows.
• Updated the following workflow files: .github/workflows/demo-asi-global.yml, .github/workflows/demo-asi-takeoff.yml, .github/workflows/demo-aurora.yml, .github/workflows/demo-zenith-hypernova.yml, .github/workflows/demo-zenith-sapience-celestial-archon.yml, .github/workflows/demo-zenith-sapience-initiative.yml, .github/workflows/demo-zenith-sapience-omnidominion.yml, and .github/workflows/demo-zenith-sapience-planetary-os.yml.
• The guard preserves uploads for non-pull_request events and for pull requests originating from the same repository (non-forks).

Testing

• No automated tests were executed because this is a workflow-only change.
• Behavior will be validated on subsequent workflow runs where CI executes these demo workflows under both forked and non-forked contexts.

---

Codex Task

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: e40ec4b562

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Treat forked repos' internal PRs as non-fork

This guard uses github.event.pull_request.head.repo.fork == false to decide whether a PR is “from a fork,” but head.repo.fork is true for any repository that itself is a fork. If this repo is a fork (e.g., downstream or mirrored forks), then same-repo PRs will now skip artifact uploads even though the token has write access, which is a behavior regression for internal PRs. Consider checking github.event.pull_request.head.repo.full_name == github.repository (or comparing repo IDs) so internal PRs in forked repos still upload.

Useful? React with 👍 / 👎.