chore: only sign when doing a PR release, otherwise notarizeAndSign COMPASS-9286 (#6877)

* only sign when doing a dev release

* requester expansion rather

Author: lerouxb

.evergreen/functions.yml

@@ -53,6 +53,7 @@ variables:
     MONGODB_RUNNER_LOG_DIR: ${workdir}/src/.testserver/
     DOCKERHUB_USERNAME: ${dockerhub_username}
     DOCKERHUB_PASSWORD: ${dockerhub_password}
+    REQUESTER: ${requester}
   - &compass-e2e-secrets
     E2E_TESTS_METRICS_URI: ${e2e_tests_metrics_string}
     E2E_TESTS_ATLAS_HOST: ${e2e_tests_atlas_host}
@@ -421,7 +422,8 @@ functions:
       params:
         working_dir: src
         shell: bash
-        include_expansions_in_env: [AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, AWS_SESSION_TOKEN]
+        include_expansions_in_env:
+          [AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, AWS_SESSION_TOKEN]
         env:
           ARTIFACTORY_USERNAME: ${artifactory_username}
           ARTIFACTORY_PASSWORD: ${artifactory_password}
@@ -506,7 +508,7 @@ functions:
   publish:
     - command: ec2.assume_role
       params:
-        role_arn: "arn:aws:iam::119629040606:role/s3-access.cdn-origin-compass"
+        role_arn: 'arn:aws:iam::119629040606:role/s3-access.cdn-origin-compass'
     - command: shell.exec
       params:
         working_dir: src
@@ -661,7 +663,7 @@ functions:
     - command: github.generate_token
       params:
         expansion_name: generated_token
-        permissions:  # optional
+        permissions: # optional
           actions: write
     - command: shell.exec
       # Fail the task if it's idle for 10 mins

packages/hadron-build/lib/mac-notary-service.js

@@ -67,7 +67,7 @@ async function notarize(src, notarizeOptions) {
         '-t',
         'app',
         '-m',
-        'notarizeAndSign',
+        process.env.REQUESTER === 'github_pr' ? 'sign' : 'notarizeAndSign',
         '-u',
         process.env.MACOS_NOTARY_API_URL,
         '-b',