fix: macos code signing (#1725)

Signed-off-by: Adam Setch <[email protected]>

Author: setchy

.github/workflows/ci.yml

@@ -5,8 +5,8 @@ on:
     branches:
       - main
   pull_request:
-    branches:
-      - main
+    branches-ignore:
+      - release/v*.*.* # macOS code-signing only works on `push` events, not `pull_request` events
 
 jobs:
   lint:
@@ -23,14 +23,12 @@ jobs:
     uses: ./.github/workflows/build.yml
     needs: tests
     if: ${{ !startsWith(github.head_ref, 'release/v') }}
-    secrets: inherit
 
   release:
     name: Release
     uses: ./.github/workflows/release.yml
     needs: tests
     if: ${{ startsWith(github.head_ref, 'release/v') }}
-    secrets: inherit
     permissions: 
       contents: write
 

.github/workflows/renovate.yml

@@ -5,10 +5,10 @@ on:
     branches:
       - main
     paths:
-      - 'renovate.json'
+      - renovate.json
   pull_request:
     paths:
-      - 'renovate.json'
+      - renovate.json
 
 jobs:
   renovate-config-validator:

.github/workflows/website.yml

@@ -2,7 +2,8 @@ name: Website
 
 on:
   push:
-    tags: 'v*'
+    tags: 
+      - v*.*.*
   workflow_dispatch: # For manually verify website deployment
 
 jobs: