Fix analysis workflow (#296)

* Skip pull request event for fossa job

* Run scorecards workflow on pr and main branch

.github/workflows/analysis.yml

@@ -18,9 +18,12 @@ on:
 permissions: read-all
 
 jobs:
-  analysis:
+  scorecards:
     name: Scorecards
     uses: wabarc/.github/.github/workflows/reusable-scorecards.yml@main
+    if: |
+      github.event_name == 'pull_request' ||
+      github.ref == 'refs/heads/main'
     permissions:
       # Needed to upload the results to code-scanning dashboard.
       security-events: write
@@ -57,7 +60,7 @@ jobs:
     uses: wabarc/.github/.github/workflows/reusable-semgrep.yml@main
 
   fossa:
-    if: github.repository == 'wabarc/wayback'
+    if: github.event_name != 'pull_request'
     name: FOSSA
     uses: wabarc/.github/.github/workflows/reusable-fossa.yml@main
     secrets: