to jobs:

to check if the origin comes from internal repo or external fork and
use that to determine which to run

Setup correct environment

Switch docker_image workflow to using environment secrets so that iX can approve collaborator CI runs.