CI: Stub Update with PAT

.github/workflows/ci.yml

@@ -1,49 +1,52 @@
 name: 👑 CI
 
-# This workflow updates the .pyi stub files for documentation and interactive use.
-
-on: [push, pull_request, pull_request_target]
+on: [push, pull_request]
 
 concurrency:
   group: ${{ github.ref }}-${{ github.head_ref }}-ci
   cancel-in-progress: true
 
 jobs:
+  stubs:
+    # Pushes should only run on mainline branch "development"
+    if: github.event_name == 'push' && github.repository == 'AMReX-Codes/pyamrex' && github.ref == 'refs/heads/development'
+    name: 🔄 Update Stub Files
+    permissions:
+      # Give the default GITHUB_TOKEN write permission to commit and push the
+      # changed files back to the repository.
+      contents: write
+    uses: ./.github/workflows/stubs.yml
+
   ubuntu:
-    if: github.event_name != 'pull_request_target'
+    if: github.event.pull_request.draft == false
     name: 🐧 Ubuntu
+    needs: [stubs]
     uses: ./.github/workflows/ubuntu.yml
 
   intel:
-    if: github.event_name != 'pull_request_target'
+    if: github.event.pull_request.draft == false
     name: 🐧 Intel
+    needs: [stubs]
     uses: ./.github/workflows/intel.yml
 
   hip:
-    if: github.event_name != 'pull_request_target'
+    if: github.event.pull_request.draft == false
     name: 🐧 HIP
+    needs: [stubs]
     uses: ./.github/workflows/hip.yml
 
   macos:
-    if: github.event_name != 'pull_request_target'
+    if: github.event.pull_request.draft == false
     name: 🍏 macOS
+    needs: [stubs]
     uses: ./.github/workflows/macos.yml
 
   windows:
-    if: github.event_name != 'pull_request_target'
+    if: github.event.pull_request.draft == false
     name: 🪟 Windows
+    needs: [stubs]
     uses: ./.github/workflows/windows.yml
 
-  stubs:
-    if: github.event_name != 'pull_request'
-    name: 🔄 Update Stub Files
-    needs: [ubuntu, intel, hip, macos, windows]
-    permissions:
-      # Give the default GITHUB_TOKEN write permission to commit and push the
-      # changed files back to the repository.
-      contents: write
-    uses: ./.github/workflows/stubs.yml
-
   save_pr_number:
     if: github.event_name != 'push'
     runs-on: ubuntu-latest

.github/workflows/stubs.yml

@@ -19,7 +19,6 @@ jobs:
       CXXFLAGS: "-O1"
       OMP_NUM_THREAD: 2
 
-    if: github.event.pull_request.draft == false
     permissions:
       # Give the default GITHUB_TOKEN write permission to commit and push the
       # changed files back to the repository.
@@ -28,8 +27,7 @@ jobs:
     steps:
     - uses: actions/checkout@v3
       with:
-        repository: ${{ github.event.pull_request.head.repo.full_name }}
-        ref: ${{ github.head_ref }}
+        token: ${{ secrets.PYAMREX_PUSH_TOKEN }}
 
     - name: Pull Remote Changes
       run: git pull