From 5780e0cab513fd5ed72455fd8ba7a7e84d959978 Mon Sep 17 00:00:00 2001
From: Adam Setch <adam.setch@outlook.com>
Date: Tue, 14 Jan 2025 09:18:20 -0500
Subject: [PATCH] fix: macos code signing

Signed-off-by: Adam Setch <adam.setch@outlook.com>
---
 .github/workflows/ci.yml       | 6 ++----
 .github/workflows/renovate.yml | 4 ++--
 .github/workflows/website.yml  | 3 ++-
 3 files changed, 6 insertions(+), 7 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 2c6bb7073..e15fc460d 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -5,8 +5,8 @@ on:
     branches:
       - main
   pull_request:
-    branches:
-      - main
+    branches-ignore:
+      - release/v*.*.* # macOS code-signing only works on `push` events, not `pull_request` events
 
 jobs:
   lint:
@@ -23,14 +23,12 @@ jobs:
     uses: ./.github/workflows/build.yml
     needs: tests
     if: ${{ !startsWith(github.head_ref, 'release/v') }}
-    secrets: inherit
 
   release:
     name: Release
     uses: ./.github/workflows/release.yml
     needs: tests
     if: ${{ startsWith(github.head_ref, 'release/v') }}
-    secrets: inherit
     permissions: 
       contents: write
 
diff --git a/.github/workflows/renovate.yml b/.github/workflows/renovate.yml
index fa590ffd0..7447afbd0 100644
--- a/.github/workflows/renovate.yml
+++ b/.github/workflows/renovate.yml
@@ -5,10 +5,10 @@ on:
     branches:
       - main
     paths:
-      - 'renovate.json'
+      - renovate.json
   pull_request:
     paths:
-      - 'renovate.json'
+      - renovate.json
 
 jobs:
   renovate-config-validator:
diff --git a/.github/workflows/website.yml b/.github/workflows/website.yml
index f851df95e..9e8bad574 100644
--- a/.github/workflows/website.yml
+++ b/.github/workflows/website.yml
@@ -2,7 +2,8 @@ name: Website
 
 on:
   push:
-    tags: 'v*'
+    tags: 
+      - v*.*.*
   workflow_dispatch: # For manually verify website deployment
 
 jobs: