Ignore fork PRs in check suite webhooks

[trask]

Prevent check suite webhooks from dispatching targeted dashboard refreshes for PR associations that belong to another repository. GitHub can associate an upstream check suite with a fork PR whose head is the upstream repository, so the webhook bridge now only accepts check-suite PR numbers when the PR URL or base repository matches the repository that emitted the event.

Observed in failed dashboard run: https://github.com/open-telemetry/shared-workflows/actions/runs/29034606155/job/86176101390

[Copilot]

Pull request overview

This PR hardens the pull request dashboard's webhook bridge (github-webhook.js, a Netlify function that translates incoming GitHub webhooks into targeted dashboard refresh dispatches). Previously, when a check_suite event arrived, any PR listed in check_suite.pull_requests with a valid number would trigger a dispatch. Because GitHub can associate an upstream repository's check suite with a fork PR (when commit SHAs are shared), this could dispatch refreshes for PR numbers that belong to a different repository. The change adds ownership validation so only PRs whose own API URL or base repository match the repository that emitted the event are accepted.

Changes:

• Renamed/refactored extractPullRequestNumberFromPullRequests (which accepted an array of lists) into extractPullRequestNumberFromCheckSuitePullRequests, taking a single list plus the payload repository.
• Added checkSuitePullRequestBelongsToRepository to confirm a check-suite PR belongs to the emitting repository via the PR's API URL or its base.repo.url.
• Added repositoryUrlFromPullRequestApiUrl helper to derive the repository API URL from a PR API URL.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.