Exlude job for tags in forks

I have quite a simple build for a project that has forks.
I would like to restrict deployment jobs only on tags on the upstream.

Today I have my .gitlab-ci.yml:

stages:
  - build
  - deploy

build:
  stage: build
  script: 
    - echo This is the build, for upstream & forks.

deployment:
  stage: deploy
  only:
    - tags
  script: 
    - echo Perform this only on the upstream !!!

But if someone from a fork, creates and push a tag then the deployment job is executed. I want to restrict this execution only on the upstream project. Is that possible?