In homebrew/cask CI, the signing audit intermittently fails on the macos-15 runner with Signature verification failed for <X>: rejected, while macos-26 and xcode-27 accept the same artifacts in the same run. Locally, the artifacts verify as notarized, and a re-run often clears the failure. Each one costs a maintainer a re-run and an investigation.

macos-15 runners are only included when the cask definition specifically requires the variation.

This PR adds signing to the macos-15 job's --except only when another macOS runner downloads the same URL, so the artifact is still signing-audited elsewhere. A URL that only macos-15 downloads keeps its signing check, as does a cask limited to macos-15. Every other audit still runs on macos-15.

Below is a table that shows how many signing audits will be skipped on macos-15 after this change (1,246), and how many will still be explicitly checked (12).

Casks
Count

Get a macos-15 job
1,258

macos-15 shares its URL with another macOS runner
1,246

macos-15 downloads a URL no other runner audits
12

• [x] Have you followed our Contributing guidelines?


• [x] Have you checked for other open Pull Requests for the same change?


• [x] Have you explained what your changes do? Performance claims (e.g. "this is faster") must include brew benchmark results.


• [x] Have you explained why you'd like these changes included, not just what they do?


• [ ] For bug fixes, have you given step-by-step brew commands to reproduce the bug?


• [x] Have you written new tests (excluding integration tests)? Here's an example.


• [x] Have you successfully run brew lgtm (style, typechecking and tests) locally?

• [x] I did not use AI/LLM to create this PR, or I disclosed the tool/model below and reviewed its output; I did not attribute commits to AI and will answer maintainer questions and review comments myself without AI/LLM.

Claude with Opus 5.5 at Extra High effort, with local review and testing.