don't attest on PRs

Author: TropheusJ

.github/workflows/build.yml

@@ -45,6 +45,7 @@ jobs:
         run: ./gradlew build
 
       - name: Attest Build Provenance
+        if: github.event_name != 'pull_request'
         uses: actions/attest@v4
         with:
           subject-path: 'build/libs/*.jar'