use signing keys only on tagged releases

gliwka · Nov 24, 2023 · 793338c · 793338c
1 parent 0f072f1
commit 793338c
Showing 1 changed file with 7 additions and 4 deletions.
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
@@ -27,11 +27,11 @@ jobs:
       matrix:
         include:
           - os: macos
-            runner: macos-12 #x86_64
+            runner: macos-12
             shell: bash
             platform: macosx-x86_64
           - os: macos
-            runner: macos-12-large #arm64
+            runner: macos-12-large
             shell: bash
             platform: macosx-arm64
           - os: linux
@@ -43,8 +43,6 @@ jobs:
             shell: bash
             platform: linux-arm64
     env:
-      SIGN_KEY: ${{ secrets.SIGN_KEY }}
-      SIGN_KEY_PASS: ${{ secrets.SIGN_KEY_PASS }}
       STAGING_REPO: ${{ needs.create-staging-repo.outputs.staging-repo }}
       DETECTED_PLATFORM: ${{ matrix.platform }}
       STAGING: ${{ startsWith(github.ref, 'refs/tags/v') }}
@@ -55,6 +53,11 @@ jobs:
         if: matrix.os == 'macos'
         with:
           xcode-version: latest-stable
+      - name: Set signing keys
+        if: startsWith(github.ref, 'refs/tags/v') == true
+        run: |
+          echo "SIGN_KEY=${{ secrets.SIGN_KEY }}" >> "$GITHUB_ENV"
+          echo "SIGN_KEY_PASS=${{ secrets.SIGN_KEY_PASS }}" >> "$GITHUB_ENV"
       - name: Build native binaries
         run: ./build.sh deploy
         if: matrix.os != 'linux'