only dep-signing on push

fenix-signing.diff

diff --git a/taskcluster/ci/signing/kind.yml b/taskcluster/ci/signing/kind.yml
index c1880f856..11048e088 100644
--- a/taskcluster/ci/signing/kind.yml
+++ b/taskcluster/ci/signing/kind.yml
@@ -13,42 +13,51 @@ kind-dependencies:
     - build
 
 primary-dependency: build
 
 group-by: build-type
 
 job-template:
     description: Sign Fenix
     worker-type:
-        by-build-type:
-            (nightly|beta|release|android-test-nightly):
-                by-level:
-                    '3': signing
+        by-tasks-for:
+            (cron|github-release|action):
+                by-build-type:
+                    (nightly|beta|release|android-test-nightly):
+                        by-level:
+                            '3': signing
+                            default: dep-signing
                     default: dep-signing
             default: dep-signing
     worker:
         signing-type:
-            by-build-type:
-                (beta|release):
-                    by-level:
-                        '3': fennec-production-signing
-                        default: dep-signing
-                performance-test: dep-signing
-                (nightly|android-test-nightly):
-                    by-level:
-                        '3': production-signing
+            by-tasks-for:
+                (cron|github-release|action):
+                    by-build-type:
+                        (beta|release):
+                            by-level:
+                                '3': fennec-production-signing
+                                default: dep-signing
+                        performance-test: dep-signing
+                        (nightly|android-test-nightly):
+                            by-level:
+                                '3': production-signing
+                                default: dep-signing
                         default: dep-signing
                 default: dep-signing
     signing-format: autograph_apk
     index:
-        by-build-type:
-            (nightly|debug|nightly-simulation|beta|release):
-                type: signing
+        by-tasks-for:
+            (cron|github-release|action):
+                by-build-type:
+                    (nightly|debug|nightly-simulation|beta|release):
+                        type: signing
+                    default: {}
             default: {}
     run-on-tasks-for:
         by-build-type:
             # No test job runs on push against this build type. Although we do want nightly-simulation
             # signed to use it in the gecko trees.
             # We want beta on push so that we detect problem before shipping it
             (nightly-simulation|beta-firebase|android-test-beta|nightly-firebase|android-test-nightly): [github-push]
             default: []
     treeherder:
diff --git a/taskcluster/fenix_taskgraph/transforms/signing.py b/taskcluster/fenix_taskgraph/transforms/signing.py
index 8c6570fcc..b3cf7661e 100644
--- a/taskcluster/fenix_taskgraph/transforms/signing.py
+++ b/taskcluster/fenix_taskgraph/transforms/signing.py
@@ -20,18 +20,19 @@ def resolve_keys(config, tasks):
     for task in tasks:
         for key in ("index", "run-on-tasks-for", "worker-type", "worker.signing-type", "signing-format"):
             resolve_keyed_by(
                 task,
                 key,
                 item_name=task["name"],
                 **{
                     'build-type': task["attributes"]["build-type"],
                     'level': config.params["level"],
+                    'tasks-for': config.params["tasks_for"],
                 }
             )
         yield task
 
 
 @transforms.add
 def set_signing_attributes(config, tasks):
     for task in tasks:
         task["attributes"]["signed"] = True