What about…

* accept both `push` and `pull_request` by default
* public repo: only build if user is a collaborator on upstream
* private repo: only build if user is on a team with push permissions on upstream