Stop using 'push' event to determine privileged post-submit runs.

Both 'schedule' and 'workflow_dispatch' are valid alternatives today.  What we really want here is anything *except* pull request events.

PiperOrigin-RevId: 509123777

Author: mkruskal-google

.github/actions/bazel-docker/action.yml

@@ -71,5 +71,5 @@ runs:
 
     - name: Save Bazel repository cache
       # Only allow repository cache updates during post-submits.
-      if: ${{ github.event_name == 'push' }}
+      if: ${{ github.event_name != 'pull_request' && github.event_name != 'pull_request_target' }}
       uses: ./.github/actions/internal/repository-cache-save

.github/actions/bazel/action.yml

@@ -63,14 +63,14 @@ runs:
       run: echo "BAZELISK_PATH=$LOCALAPPDATA\bazelisk" >> $GITHUB_ENV
 
     - name: Cache Bazelisk
-      if: ${{ github.event_name == 'push' }}
+      if: ${{ github.event_name != 'pull_request' && github.event_name != 'pull_request_target' }}
       uses: actions/cache@627f0f41f6904a5b1efbaed9f96d9eb58e92e920 # v3.2.4
       with:
         path: ${{ env.BAZELISK_PATH }}
         key: bazel-${{ runner.os }}-${{ inputs.version }}
 
     - name: Restore Bazelisk
-      if: ${{ github.event_name != 'push' }}
+      if: ${{ github.event_name == 'pull_request' || github.event_name == 'pull_request_target' }}
       uses: actions/cache/restore@627f0f41f6904a5b1efbaed9f96d9eb58e92e920 # v3.2.4
       with:
         path: ${{ env.BAZELISK_PATH }}
@@ -107,5 +107,5 @@ runs:
 
     - name: Save Bazel repository cache
       # Only allow repository cache updates during post-submits.
-      if: ${{ github.event_name == 'push' }}
+      if: ${{ github.event_name != 'pull_request' && github.event_name != 'pull_request_target'}}
       uses: ./.github/actions/internal/repository-cache-save

.github/workflows/test_runner.yml

@@ -57,7 +57,8 @@ jobs:
     # repository, it's safe and we can use `pull_request`.  Otherwise, we should
     # use `pull_request_target`.
     if: |
-      (github.event_name == 'push' &&
+      (github.event_name != 'pull_request' &&
+       github.event_name != 'pull_request_target' &&
        github.event.repository.full_name == 'protocolbuffers/protobuf') ||
       (github.event_name == 'pull_request' &&
        github.event.pull_request.head.repo.full_name == 'protocolbuffers/protobuf') ||