build only on main and PRs (#14)

Co-authored-by: cultivator[bot] <343217+cultivator[bot]@users.noreply.github.com>

.github/workflows/build.yml

@@ -1,7 +1,12 @@
+---
 name: Build
-on:
-  pull_request:
+'on':
   push:
+    branches:
+    - main
+    tags:
+    - "**"
+  pull_request_target:
 jobs:
   build:
     name: Build
@@ -10,7 +15,7 @@ jobs:
       contents: write
       packages: read
     env:
-      PKGFORGE_STATEFILE: /tmp/pkgforge
+      PKGFORGE_STATEFILE: "/tmp/pkgforge"
     steps:
     - name: Checkout
       uses: actions/checkout@v3
@@ -23,19 +28,19 @@ jobs:
     - name: Publish
       if: startsWith(github.ref, 'refs/tags/')
       env:
-        AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
-        AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+        AWS_ACCESS_KEY_ID: "${{ secrets.AWS_ACCESS_KEY_ID }}"
+        AWS_SECRET_ACCESS_KEY: "${{ secrets.AWS_SECRET_ACCESS_KEY }}"
         AWS_DEFAULT_REGION: us-east-1
         BUCKET: akerl-githubauthlambda
       run: aws s3 cp pkg/payload.zip "s3://$BUCKET/$GITHUB_REF_NAME.zip"
     - name: Release
       if: startsWith(github.ref, 'refs/tags/')
       run: make release
       env:
-        GITHUB_TOKEN: ${{ github.token }}
+        GITHUB_TOKEN: "${{ github.token }}"
     - name: Post to hook-exporter
-      run: ./.github/exporter.sh
+      run: "./.github/exporter.sh"
       env:
-        EXPORTER_TOKEN: ${{ secrets.EXPORTER_TOKEN }}
-        JOB_STATUS: ${{ job.status }}
-      if: ${{ always() }}
+        EXPORTER_TOKEN: "${{ secrets.EXPORTER_TOKEN }}"
+        JOB_STATUS: "${{ job.status }}"
+      if: "${{ always() }}"