From 6a58132a9bfc82447d4c1bcc13a38afdc0e43cba Mon Sep 17 00:00:00 2001
From: Andrii Borziak <aborziak@microsoft.com>
Date: Wed, 30 Sep 2026 16:00:06 -0700
Subject: [PATCH] CI: only sign and publish packages on push

Fork PRs don't receive repository secrets, so the sign job failed on them. Also stops unmerged PR builds from being pushed to the MainLatest feed.
---
 .github/workflows/dotnet-build.yml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.github/workflows/dotnet-build.yml b/.github/workflows/dotnet-build.yml
index c87d1613..0ea9feb6 100644
--- a/.github/workflows/dotnet-build.yml
+++ b/.github/workflows/dotnet-build.yml
@@ -88,6 +88,7 @@ jobs:
 
   sign:
     needs: [build_lottie]
+    if: ${{ github.event_name == 'push' }}
     runs-on: windows-latest
     permissions:
       id-token: write # Required for requesting the JWT