ci: update runner types and permissions in workflow files

.github/workflows/ci-quality-checks.yml

@@ -21,6 +21,7 @@ env:
 
 jobs:
     test:
+        if: github.repository == 'dream-num/univer'
         runs-on: ubuntu-latest
         env:
             TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}
@@ -44,6 +45,7 @@ jobs:
                   CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
 
     eslint:
+        if: github.repository == 'dream-num/univer'
         runs-on: ubuntu-latest
 
         steps:
@@ -67,6 +69,7 @@ jobs:
               run: pnpm lint --quiet --cache --cache-location .eslintcache
 
     typecheck:
+        if: github.repository == 'dream-num/univer'
         runs-on: ubuntu-latest
         env:
             TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}

.github/workflows/collect-pr-metadata.yml

@@ -6,17 +6,21 @@ on:
         types: [opened, synchronize, reopened, closed]
 
 permissions:
-    actions: write
+    contents: read
     pull-requests: read
 
 concurrency:
     group: ${{ github.workflow }}-${{ github.ref }}
     cancel-in-progress: true
 
+env:
+    TURBO_TELEMETRY_DISABLED: '1'
+
 jobs:
     set-pr-info:
         name: set PR info
-        runs-on: ubuntu-latest
+        if: github.repository == 'dream-num/univer'
+        runs-on: minimum-runner
         steps:
             - name: Save PR info
               env:

.github/workflows/deploy-github-pages.yml

@@ -19,6 +19,7 @@ permissions:
 
 jobs:
     deploy:
+        if: github.repository == 'dream-num/univer'
         runs-on: ubuntu-latest
 
         steps:

.github/workflows/deploy-pr-preview.yml

@@ -21,7 +21,7 @@ env:
 
 jobs:
     setup:
-        if: ${{ github.event.workflow_run.conclusion == 'success' && github.event.workflow_run.head_repository.full_name == github.repository }}
+        if: ${{ github.repository == 'dream-num/univer' && github.event.workflow_run.conclusion == 'success' && github.event.workflow_run.head_repository.full_name == github.repository }}
         runs-on: ubuntu-latest
 
         outputs:
@@ -82,7 +82,7 @@ jobs:
     prepare:
         runs-on: ubuntu-latest
         needs: [setup]
-        if: ${{ needs.setup.outputs.id != '' && needs.setup.outputs.state != 'closed' }}
+        if: ${{ github.repository == 'dream-num/univer' && needs.setup.outputs.id != '' && needs.setup.outputs.state != 'closed' }}
 
         steps:
             # ================= Create Comment =================
@@ -116,7 +116,7 @@ jobs:
     build-and-deploy:
         runs-on: ubuntu-latest
         needs: [setup]
-        if: ${{ needs.setup.outputs.id != '' }}
+        if: ${{ github.repository == 'dream-num/univer' && needs.setup.outputs.id != '' }}
 
         steps:
             - name: Checkout
@@ -189,32 +189,3 @@ jobs:
                   pr-number: ${{ needs.setup.outputs.id }}
                   comment: false
                   action: ${{ needs.setup.outputs.state == 'closed' && 'remove' || 'deploy' }}
-
-    notify:
-        runs-on: ubuntu-latest
-        needs: [setup, build-and-deploy]
-        if: ${{ needs.setup.outputs.id != '' && needs.setup.outputs.state != 'closed' }}
-
-        steps:
-            # ================= Create Comment =================
-            - name: 🧽 Find And Delete Comment
-              uses: peter-evans/find-comment@v4
-              if: ${{ needs.setup.outputs.id != '' }}
-              id: fc
-              with:
-                  issue-number: ${{ needs.setup.outputs.id }}
-                  comment-author: 'github-actions[bot]'
-                  body-includes: View Deployment
-
-            - name: 📝 Create or update comment
-              uses: peter-evans/create-or-update-comment@v5
-              if: ${{ needs.setup.outputs.id != '' }}
-              with:
-                  comment-id: ${{ steps.fc.outputs.comment-id }}
-                  issue-number: ${{ needs.setup.outputs.id }}
-                  body: |
-                      ## View Deployment
-                      | 📑 Demo (React@19) | Demo (React@16) | 📚 Storybook |
-                      | --- | --- | --- |
-                      | [🔗 Preview link](https://dream-num.github.io/univer/pr-preview/pr-${{ needs.setup.outputs.id }}/) | [🔗 Preview link](https://dream-num.github.io/univer/pr-preview/pr-${{ needs.setup.outputs.id }}/react16/) | [🔗 Preview link](https://dream-num.github.io/univer/pr-preview/pr-${{ needs.setup.outputs.id }}/storybook/) |
-                  edit-mode: replace

.github/workflows/e2e.yml

@@ -20,6 +20,7 @@ env:
 jobs:
     e2e-shard:
         name: e2e-test shard (${{ matrix.shard-index }}/${{ matrix.shard-total }})
+        if: github.repository == 'dream-num/univer'
         runs-on: ubuntu-latest
 
         strategy:
@@ -82,7 +83,7 @@ jobs:
         name: e2e-test
         runs-on: ubuntu-latest
         needs: e2e-shard
-        if: ${{ always() }}
+        if: ${{ always() && github.repository == 'dream-num/univer' }}
 
         steps:
             - name: Check shard results

.github/workflows/release-npm.yml

@@ -20,20 +20,13 @@ env:
 
 jobs:
     prepare:
+        if: github.repository == 'dream-num/univer'
         runs-on: ubuntu-latest
 
         outputs:
             release_type: ${{ steps.release-type.outputs.value }}
 
         steps:
-            - name: Checkout
-              uses: actions/checkout@v7
-              with:
-                  persist-credentials: false
-
-            - name: Setup Node.js
-              uses: ./.github/actions/setup-node
-
             - name: 🚚 Get release type
               id: release-type
               env:

.github/workflows/security-semgrep.yml

@@ -18,6 +18,7 @@ permissions:
 
 jobs:
     semgrep:
+        if: github.repository == 'dream-num/univer'
         runs-on: ubuntu-latest
         timeout-minutes: 20
 

.github/workflows/sync-gitee-mirror.yml

@@ -9,10 +9,10 @@ on:
 jobs:
     sync:
         if: github.repository == 'dream-num/univer'
-        runs-on: ubuntu-latest
+        runs-on: minimum-runner
         steps:
             - name: Sync Gitee
-              uses: jikkai/sync-gitee@main
+              uses: jikkai/sync-gitee@v1
               with:
                   repository: dream-num/univer
                   username: ${{ secrets.GITEE_USERNAME }}

.github/workflows/update-playwright-snapshots.yml

@@ -9,6 +9,7 @@ permissions:
 
 jobs:
     update-snapshots:
+        if: github.repository == 'dream-num/univer'
         runs-on: ubuntu-latest
         env:
             GH_TOKEN: ${{ github.token }}

.github/workflows/validate-pr-title.yml

@@ -13,7 +13,8 @@ permissions:
 jobs:
     validate:
         name: validate PR title
-        runs-on: ubuntu-latest
+        if: github.repository == 'dream-num/univer'
+        runs-on: minimum-runner
 
         steps:
             - uses: amannn/action-semantic-pull-request@v6