include signed publishing in github so we stop accidentally publishing the empty aggregation project