Only push to the upstream repo with git trigger.

That's usually what's meant. The broader approach has unexpected
behavior (and doesn't always work).