update publish to not use secrets and env in if conditions

Author: Anmol1696

.github/workflows/publish.yml

@@ -48,14 +48,18 @@ jobs:
         run: swift test
 
       # ──────────────────────────────────────────────
-      # Code signing (only when secrets are available)
+      # Code signing (skipped if secrets not configured)
       # ──────────────────────────────────────────────
       - name: Import signing certificate
-        if: ${{ secrets.MACOS_CERTIFICATE != '' }}
         env:
           CERTIFICATE_BASE64: ${{ secrets.MACOS_CERTIFICATE }}
           CERTIFICATE_PASSWORD: ${{ secrets.MACOS_CERTIFICATE_PWD }}
         run: |
+          if [ -z "$CERTIFICATE_BASE64" ]; then
+            echo "No signing certificate configured, skipping code signing"
+            exit 0
+          fi
+
           KEYCHAIN_PATH="$RUNNER_TEMP/build.keychain-db"
           KEYCHAIN_PASSWORD=$(openssl rand -base64 32)
 
@@ -78,12 +82,16 @@ jobs:
           echo "SIGNING_AVAILABLE=true" >> $GITHUB_ENV
 
       - name: Store notarization credentials
-        if: ${{ secrets.APPLE_ID != '' }}
         env:
           APPLE_ID: ${{ secrets.APPLE_ID }}
           APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
           APPLE_APP_PASSWORD: ${{ secrets.APPLE_APP_PASSWORD }}
         run: |
+          if [ -z "$APPLE_ID" ]; then
+            echo "No notarization credentials configured, skipping"
+            exit 0
+          fi
+
           xcrun notarytool store-credentials "AC_PASSWORD" \
             --apple-id "$APPLE_ID" \
             --team-id "$APPLE_TEAM_ID" \
@@ -95,14 +103,21 @@ jobs:
       # ──────────────────────────────────────────────
       - name: Build, sign, and notarize
         working-directory: app/macos
-        env:
-          DEVELOPER_ID: ${{ env.SIGNING_AVAILABLE == 'true' && 'Developer ID Application' || '' }}
-          NOTARIZE: ${{ env.NOTARIZATION_AVAILABLE == 'true' && '1' || '' }}
-        run: bash build.sh
+        run: |
+          if [ "$SIGNING_AVAILABLE" = "true" ]; then
+            export DEVELOPER_ID="Developer ID Application"
+          fi
+          if [ "$NOTARIZATION_AVAILABLE" = "true" ]; then
+            export NOTARIZE=1
+          fi
+          bash build.sh
 
       - name: Cleanup keychain
-        if: always() && env.KEYCHAIN_PATH != ''
-        run: security delete-keychain "$KEYCHAIN_PATH" || true
+        if: always()
+        run: |
+          if [ -n "$KEYCHAIN_PATH" ]; then
+            security delete-keychain "$KEYCHAIN_PATH" || true
+          fi
 
       - name: Calculate SHA256
         id: sha