use sigstore only when publishing via github actions

use sigstore only when publishing via github actions #4351