From 1af05a453060a25f173beec7c1fde47279fa335d Mon Sep 17 00:00:00 2001
From: Alexander Medvedev <lilalexmed@proton.me>
Date: Thu, 9 Jul 2026 20:46:22 +0200
Subject: [PATCH] ci: only sign on master

---
 .github/workflows/rust.yml | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/rust.yml b/.github/workflows/rust.yml
index 5630cf35e..643bbf637 100644
--- a/.github/workflows/rust.yml
+++ b/.github/workflows/rust.yml
@@ -139,7 +139,7 @@ jobs:
           cp "target/release/pumpkin$EXT" "dist/pumpkin-${{ runner.arch }}-${{ runner.os }}$EXT"
 
       - name: Upload unsigned executable for SignPath (Windows only)
-        if: runner.os == 'Windows'
+        if: runner.os == 'Windows' && github.event_name == 'push' && github.ref == 'refs/heads/master'
         id: upload_unsigned
         uses: actions/upload-artifact@v7
         with:
@@ -148,7 +148,7 @@ jobs:
           retention-days: 1
 
       - name: Submit SignPath signing request (Windows only)
-        if: runner.os == 'Windows'
+        if: runner.os == 'Windows' && github.event_name == 'push' && github.ref == 'refs/heads/master'
         uses: signpath/github-action-submit-signing-request@v2
         with:
           api-token: '${{ secrets.SIGNPATH_API_TOKEN }}'
@@ -160,7 +160,7 @@ jobs:
           output-artifact-directory: dist/signed/
 
       - name: Overwrite with signed version (Windows only)
-        if: runner.os == 'Windows'
+        if: runner.os == 'Windows' && github.event_name == 'push' && github.ref == 'refs/heads/master'
         shell: bash
         run: |
           cp dist/signed/* dist/