ci(cd): fix invalid job-level if by moving secret checks to steps; support PR deploy via pull_request_target

Author: SkySingh04

.github/workflows/cd.yml

@@ -84,7 +84,6 @@ jobs:
   deploy-compose:
     runs-on: ubuntu-latest
     needs: build-and-push
-    if: ${{ secrets.SSH_HOST != '' && secrets.SSH_USER != '' && secrets.SSH_PRIVATE_KEY != '' && (github.event_name != 'pull_request_target' || github.event.pull_request.head.repo.full_name == github.repository) }}
     environment: production
     concurrency:
       group: prod-deploy
@@ -101,6 +100,21 @@ jobs:
         with:
           ref: ${{ env.REF }}
 
+      - name: Verify required secrets are present
+        env:
+          SSH_HOST: ${{ secrets.SSH_HOST }}
+          SSH_USER: ${{ secrets.SSH_USER }}
+          SSH_PRIVATE_KEY: ${{ secrets.SSH_PRIVATE_KEY }}
+        run: |
+          for v in SSH_HOST SSH_USER SSH_PRIVATE_KEY; do
+            if [ -z "${!v}" ]; then echo "Missing secret: $v"; exit 1; fi
+          done
+      - name: Verify PR origin (internal only)
+        if: ${{ github.event_name == 'pull_request_target' }}
+        run: |
+          if [ "${{ github.event.pull_request.head.repo.full_name }}" != "${{ github.repository }}" ]; then
+            echo "Refusing to deploy from external fork PR"; exit 1; fi
+
       - name: Upload docker-compose file
         uses: appleboy/scp-action@v0.1.7
         with: