Merge pull request #192 from superhighfives/fix/harden-github-actions

harden GitHub Actions security

Author: superhighfives

.github/workflows/tests.yml

@@ -6,9 +6,15 @@ on:
     branches: [main]
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   test:
     name: Unit Tests
+    if: >-
+      github.event_name != 'pull_request'
+      || github.event.pull_request.head.repo.full_name == github.repository
     runs-on: macos-15
 
     steps: