chore: make the repo safe and clear to fork

The repository picked up its first fork. Three things a forker would hit:

* deploy-pages, notify-engine and bump-engine publish the site or talk
  to TechEngine. In a fork they have no secrets and no Pages, so they
  can only fail. Their entry jobs now run only in GetTechAPI/TechAPI;
  deploy-pages' `deploy` job needs `build` and is skipped with it.

* The data license lived only in a README sentence, while the repo's
  sole LICENSE file is the MIT one for the code — so GitHub, and anyone
  reusing the data, sees "MIT". data/LICENSE.md restates the existing
  CC BY-SA 4.0 declaration where the data actually sits, and points to
  ../LICENSE for the code. No licensing terms change.

* The contributing section listed five categories as needing
  `source_urls`; the validator enforces it for all thirteen. The PR
  template also gains a "targets develop" check.

The two secret-bearing triggers were reviewed and need no change:
pr-metadata runs on pull_request_target but never checks out the PR,
and its only event-derived expression (html_url) is passed through env;
verify-command only accepts OWNER/MEMBER/COLLABORATOR.

Refs #1

Author: Seungpyo1007

.github/pull_request_template.md

@@ -10,6 +10,7 @@
 
 ## Checklist
 
+- [ ] The PR targets `develop` (`main` only moves through release PRs)
 - [ ] `python -m app.validate` passes locally
 - [ ] Files live at the correct `data/<category>/<...>/<slug>.json` path
 - [ ] Slugs are kebab-case and unique within the category

.github/workflows/bump-engine.yml

@@ -20,6 +20,9 @@ concurrency:
 
 jobs:
   bump:
+    # Org-only: this job publishes the site or talks to TechEngine. In a fork
+    # it can only fail (no secrets, no Pages), so it does not run there.
+    if: github.repository == 'GetTechAPI/TechAPI'
     runs-on: ubuntu-latest
     env:
       ENGINE_TOKEN: ${{ secrets.ENGINE_TOKEN }}

.github/workflows/deploy-pages.yml

@@ -21,6 +21,9 @@ concurrency:
 
 jobs:
   build:
+    # Org-only: this job publishes the site or talks to TechEngine. In a fork
+    # it can only fail (no secrets, no Pages), so it does not run there.
+    if: github.repository == 'GetTechAPI/TechAPI'
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4

.github/workflows/notify-engine.yml

@@ -27,6 +27,9 @@ permissions:
 
 jobs:
   notify:
+    # Org-only: this job publishes the site or talks to TechEngine. In a fork
+    # it can only fail (no secrets, no Pages), so it does not run there.
+    if: github.repository == 'GetTechAPI/TechAPI'
     runs-on: ubuntu-latest
     env:
       ENGINE_TOKEN: ${{ secrets.ENGINE_TOKEN }}

README.md

@@ -62,12 +62,14 @@ submodule bump and the verified-promotion bot both land on `develop`.
 
 ## Contributing
 
-Open a PR **against `develop`** with the new/updated JSON file. The PR template
-walks through what to include. The validator must pass. All records (`brand`,
-`soc`, `smartphone`, `gpu`, and `cpu`) must include `source_urls` with at least
-one canonical reference (vendor product page, Wikipedia infobox, datasheet).
+Open a PR **against `develop`** with the new/updated JSON file — that is also
+the default branch, so a PR from a fork targets it automatically. The PR
+template walks through what to include, and the validator must pass. Every
+record, in every category, must include `source_urls` with at least one
+canonical reference (vendor product page, Wikipedia infobox, datasheet).
 
 ## License
 
-Data is licensed **CC-BY-SA 4.0**; attribute "Data from TechAPI" and share alike.
+Data is licensed **CC-BY-SA 4.0**; attribute "Data from TechAPI" and share alike
+(see [`data/LICENSE.md`](data/LICENSE.md)).
 The bundled validator code is [MIT](LICENSE).

data/LICENSE.md

@@ -0,0 +1,15 @@
+# Data license
+
+The dataset in this directory (`data/**`), and the static JSON API generated
+from it (`site/public/v1/**`), are licensed under **Creative Commons
+Attribution-ShareAlike 4.0 International (CC BY-SA 4.0)**:
+<https://creativecommons.org/licenses/by-sa/4.0/>
+
+When you reuse the data, attribute it as "Data from TechAPI" with a link to
+<https://github.com/GetTechAPI/TechAPI>, and release derived datasets under the
+same license. Each record also lists the sources it was compiled from in its
+`source_urls` field.
+
+This notice restates the license declared in the top-level `README.md`. The
+code in this repository — the validator, the site and the workflows — is
+licensed separately under MIT; see [`../LICENSE`](../LICENSE).