only try to sign unsigned assets

.github/workflows/build.yml

@@ -441,13 +441,13 @@ jobs:
         shell: bash
         run: |
           shopt -s nullglob
-          for ARTIFACT in "${{ env.BUILD_ARTIFACTS_PATH }}"/*.{exe,zip,msi}; do
+          for ARTIFACT in "${{ env.BUILD_ARTIFACTS_PATH }}"/*_unsigned.{exe,zip,msi}; do
             echo "Processing $ARTIFACT"
             FILENAME=$(basename "$ARTIFACT")
             BASE_NAME="${FILENAME%.*}"
             EXTENSION="${FILENAME##*.}"
-            # Remove '_unsigned' from the base name if it exists
-            SIGNED_BASE_NAME="${BASE_NAME/_unsigned/}"
+            # Remove '_unsigned' from the base name
+            SIGNED_BASE_NAME="${BASE_NAME%_unsigned}"
             
             # Sign and rename EXE and MSI files
             if [[ "$EXTENSION" == "exe" || "$EXTENSION" == "msi" ]]; then