use sigstore only when publishing via github actions

use sigstore only when publishing via github actions #4350